# typo3/cms-backend (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/typo3-cms-backend Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/typo3-cms-backend.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 25 vulnerabilities in typo3/cms-backend (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-19418, was published on 11 August 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 25 (0 critical, 0 exploited in the wild) ## About typo3/cms-backend (Packagist) The typo3/cms-backend package provides the administrative backend interface for the TYPO3 content management system. ## Latest typo3/cms-backend (Packagist) vulnerabilities - [CVE-2026-19418: The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS started](https://junglewise.ai/threats/cve-2026-19418-typo3-cms-broken-access-control-in-backend-and-install-tool) (high, CVSS 4, published 11 Aug 2026) - [CVE-2026-47352: TYPO3 CMS broken access control in Backend API](https://junglewise.ai/threats/cve-2026-47352-typo3-cms-broken-access-control-in-backend-api) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-47351: TYPO3 CMS broken access control in Clipboard](https://junglewise.ai/threats/cve-2026-47351-typo3-cms-broken-access-control-in-clipboard) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-6553: TYPO3 CMS Stores Cleartext Password in User Settings Module](https://junglewise.ai/threats/cve-2026-6553-typo3-cms-stores-cleartext-password-in-user-settings-module) (high, CVSS 7.5, published 21 Apr 2026) - [CVE-2025-59020: TYPO3 CMS Allows Broken Access Control in Edit Document Controller](https://junglewise.ai/threats/cve-2025-59020-typo3-cms-allows-broken-access-control-in-edit-document) (medium, CVSS 4, published 13 Jan 2026) - [CVE-2025-59017: TYPO3 backend modules have Broken Access Control](https://junglewise.ai/threats/cve-2025-59017-typo3-backend-modules-have-broken-access-control) (medium, CVSS 4, published 9 Sep 2025) - [CVE-2025-59019: TYPO3 CSV download feature information disclosure](https://junglewise.ai/threats/cve-2025-59019-typo3-csv-download-feature-information-disclosure) (medium, CVSS 4, published 9 Sep 2025) - [CVE-2025-59014: TYPO3 Bookmark Toolbar vulnerable to denial of service](https://junglewise.ai/threats/cve-2025-59014-typo3-bookmark-toolbar-vulnerable-to-denial-of-service) (medium, CVSS 4, published 9 Sep 2025) - [CVE-2025-47941: The TYPO3 CMS Backend has Broken Authentication in Backend MFA](https://junglewise.ai/threats/cve-2025-47941-the-typo3-cms-backend-has-broken-authentication-in-backend-mfa) (low, CVSS 3.1, published 20 May 2025) - [CVE-2024-34537: Denial of Service in TYPO3 Bookmark Toolbar](https://junglewise.ai/threats/cve-2024-34537-denial-of-service-in-typo3-bookmark-toolbar) (low, CVSS 3.1, published 8 Oct 2024) - [CVE-2024-47780: Information Disclosure in TYPO3 Page Tree](https://junglewise.ai/threats/cve-2024-47780-information-disclosure-in-typo3-page-tree) (low, CVSS 3.1, published 8 Oct 2024) - [CVE-2010-3715: TYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backend](https://junglewise.ai/threats/cve-2010-3715-typo3-cross-site-scripting-xss-vulnerability-in-the-removexss) (info, published 17 May 2022) - [CVE-2008-5644: TYPO3 Cross-site Scripting vulnerability in the file backend module](https://junglewise.ai/threats/cve-2008-5644-typo3-cross-site-scripting-vulnerability-in-the-file-backend) (info, published 17 May 2022) - [CVE-2010-3659: TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms](https://junglewise.ai/threats/cve-2010-3659-typo3-cross-site-scripting-vulnerability-in-the-extension-manager) (low, CVSS 3, published 17 May 2022) - [CVE-2009-3628: TYPO3 Backend Discloses Encryption Key](https://junglewise.ai/threats/cve-2009-3628-typo3-backend-discloses-encryption-key) (info, published 2 May 2022) - [CVE-2009-3631: TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name](https://junglewise.ai/threats/cve-2009-3631-typo3-backend-command-injection-via-shell-metacharacters-in) (info, published 2 May 2022) - [CVE-2009-3629: TYPO3 Backend vulnerable to Cross-site Scripting](https://junglewise.ai/threats/cve-2009-3629-typo3-backend-vulnerable-to-cross-site-scripting) (info, published 2 May 2022) - [CVE-2009-3630: TYPO3 Backend vulnerable to Frame Hijacking](https://junglewise.ai/threats/cve-2009-3630-typo3-backend-vulnerable-to-frame-hijacking) (info, published 2 May 2022) - [CVE-2010-3664: TYPO3 is vulnerable to Information Disclosure on the backend](https://junglewise.ai/threats/cve-2010-3664-typo3-is-vulnerable-to-information-disclosure-on-the-backend) (low, CVSS 3.1, published 21 Apr 2022) - [CVE-2010-3663: TYPO3 Arbitrary Code Execution vulnerability on the backend](https://junglewise.ai/threats/cve-2010-3663-typo3-arbitrary-code-execution-vulnerability-on-the-backend) (low, CVSS 3.1, published 21 Apr 2022) - [CVE-2010-3662: TYPO3 SQL injection vulnerability on the backend](https://junglewise.ai/threats/cve-2010-3662-typo3-sql-injection-vulnerability-on-the-backend) (low, CVSS 3.1, published 21 Apr 2022) - [CVE-2010-3660: TYPO3 is vulnerable to Cross-Site Scripting (XSS) on the backend](https://junglewise.ai/threats/cve-2010-3660-typo3-is-vulnerable-to-cross-site-scripting-xss-on-the-backend) (low, CVSS 3.1, published 21 Apr 2022) - [CVE-2010-3661: TYPO3 Open Redirection vulnerability on the backend](https://junglewise.ai/threats/cve-2010-3661-typo3-open-redirection-vulnerability-on-the-backend) (low, CVSS 3.1, published 21 Apr 2022) - [CVE-2021-21370: Cross-Site Scripting in Content Preview (CType menu)](https://junglewise.ai/threats/cve-2021-21370-cross-site-scripting-in-content-preview-ctype-menu) (low, CVSS 3.1, published 23 Mar 2021) - [CVE-2021-21340: Cross-Site Scripting in Content Preview](https://junglewise.ai/threats/cve-2021-21340-cross-site-scripting-in-content-preview) (low, CVSS 3.1, published 23 Mar 2021) ## Most severe typo3/cms-backend (Packagist) vulnerabilities - [CVE-2026-6553: TYPO3 CMS Stores Cleartext Password in User Settings Module](https://junglewise.ai/threats/cve-2026-6553-typo3-cms-stores-cleartext-password-in-user-settings-module) (high, CVSS 7.5, published 21 Apr 2026) - [CVE-2026-19418: The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS started](https://junglewise.ai/threats/cve-2026-19418-typo3-cms-broken-access-control-in-backend-and-install-tool) (high, CVSS 4, published 11 Aug 2026) - [CVE-2026-47352: TYPO3 CMS broken access control in Backend API](https://junglewise.ai/threats/cve-2026-47352-typo3-cms-broken-access-control-in-backend-api) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-47351: TYPO3 CMS broken access control in Clipboard](https://junglewise.ai/threats/cve-2026-47351-typo3-cms-broken-access-control-in-clipboard) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2025-59020: TYPO3 CMS Allows Broken Access Control in Edit Document Controller](https://junglewise.ai/threats/cve-2025-59020-typo3-cms-allows-broken-access-control-in-edit-document) (medium, CVSS 4, published 13 Jan 2026) - [CVE-2025-59017: TYPO3 backend modules have Broken Access Control](https://junglewise.ai/threats/cve-2025-59017-typo3-backend-modules-have-broken-access-control) (medium, CVSS 4, published 9 Sep 2025) - [CVE-2025-59014: TYPO3 Bookmark Toolbar vulnerable to denial of service](https://junglewise.ai/threats/cve-2025-59014-typo3-bookmark-toolbar-vulnerable-to-denial-of-service) (medium, CVSS 4, published 9 Sep 2025) - [CVE-2025-59019: TYPO3 CSV download feature information disclosure](https://junglewise.ai/threats/cve-2025-59019-typo3-csv-download-feature-information-disclosure) (medium, CVSS 4, published 9 Sep 2025) - [CVE-2010-3663: TYPO3 Arbitrary Code Execution vulnerability on the backend](https://junglewise.ai/threats/cve-2010-3663-typo3-arbitrary-code-execution-vulnerability-on-the-backend) (low, CVSS 3.1, published 21 Apr 2022) - [CVE-2010-3664: TYPO3 is vulnerable to Information Disclosure on the backend](https://junglewise.ai/threats/cve-2010-3664-typo3-is-vulnerable-to-information-disclosure-on-the-backend) (low, CVSS 3.1, published 21 Apr 2022) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "typo3/cms-backend (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/typo3-cms-backend, 10 November 2026.