Packagist topthink/framework

Name: Packagist topthink/framework
Brand: Packagist

productUS

pkg:composer/topthink/framework

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

14critical3high0medium0low

updated 2026-10-29

vulnerabilities (19)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2024-44902US	critical9.8	4.24% (91st)	Exploit	no fix	2024-09-09	6.1.3 → 8.0.4
CVE-2022-47945US	critical9.8	30.2% (98th)	—	6.0.14	2022-12-23	< 6.0.14
CVE-2022-33107US	critical9.8	23.9% (98th)	—	no fix	2022-06-29	≤ 6.0.12
CVE-2022-38352US	critical9.8	21.0% (98th)	—	no fix	2022-09-15	≤ 6.0.13
CVE-2022-25481US	high7.5	4.75% (92nd)	—	no fix	2022-03-21	≤ 5.0.24
CVE-2022-44289US	high8.8	3.07% (88th)	—	no fix	2022-12-06	2 versions
CVE-2021-36567US	critical9.8	2.49% (85th)	—	no fix	2021-12-06	≤ 6.0.8
CVE-2018-16385US	critical9.8	2.15% (82nd)	—	5.1.23	2018-09-03	< 5.1.23
CVE-2021-44892US	high8.8	2.02% (81st)	—	no fix	2022-02-10	≤ 3.2.3
CVE-2021-36564US	critical9.8	1.92% (80th)	—	6.0.9	2021-12-06	< 6.0.9
CVE-2021-23592US	critical9.8	1.73% (78th)	—	6.0.12	2022-05-06	< 6.0.12
CVE-2018-18546US	critical9.8	1.66% (77th)	—	no fix	2018-10-21	≤ 3.2.4
CVE-2018-17566US	critical9.8	1.54% (75th)	—	no fix	2018-09-26	—
CVE-2021-44350US	critical9.8	1.42% (73rd)	—	no fix	2021-12-15	5.0 → 5.1.22
CVE-2018-18530US	critical9.8	1.20% (68th)	—	no fix	2018-10-19	≤ 5.1.25
CVE-2018-18529US	critical9.8	1.20% (68th)	—	no fix	2018-10-19	≤ 3.2.4
CVE-2025-50706US	—	1.11% (66th)	—	no fix	2025-08-05	≤ 5.1.41
CVE-2018-10225US	critical9.8	1.10% (66th)	—	no fix	2018-04-19	—
CVE-2024-34467US	—	0.42% (36th)	—	8.0.4	2024-05-04	3 versions

The flaw types (CWEs) most of these CVEs share.

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')7 CVEs
CWE-502Deserialization of Untrusted Data6 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-284Improper Access Control1 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type1 CVEs
CWE-668Exposure of Resource to Wrong Sphere1 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.