Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

702

Newly disclosed

Feed last synced

17 hrs ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-48221	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter	May 21, 2026 1mo ago
CVE-2026-48220	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter	May 21, 2026 1mo ago
CVE-2026-48219	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter	May 21, 2026 1mo ago
CVE-2026-48218	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters	May 21, 2026 1mo ago
CVE-2026-48217	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via delete_module.php Multiple POST Parameters	May 21, 2026 1mo ago
CVE-2026-48216	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via db_loader.php Multiple POST Parameters	May 21, 2026 1mo ago
CVE-2026-48215	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter	May 21, 2026 1mo ago
CVE-2026-48214	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter	May 21, 2026 1mo ago
CVE-2026-48213	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via add.php ticket_id Parameter	May 21, 2026 1mo ago
CVE-2026-6279	critical	9.8/10	Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler	May 21, 2026 1mo ago
CVE-2026-35016	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter	May 20, 2026 1mo ago
CVE-2026-35015	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter	May 20, 2026 1mo ago
CVE-2026-35014	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter	May 20, 2026 1mo ago
CVE-2026-35013	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via street_view.php thelat and thelng Parameters	May 20, 2026 1mo ago
CVE-2026-35012	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter	May 20, 2026 1mo ago
CVE-2026-35011	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter	May 20, 2026 1mo ago
CVE-2026-35010	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter	May 20, 2026 1mo ago
CVE-2026-35009	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter	May 20, 2026 1mo ago
CVE-2026-35008	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter	May 20, 2026 1mo ago
CVE-2026-35007	medium	5.1/10	Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter	May 20, 2026 1mo ago
CVE-2026-7637	critical	9.8/10	Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie	May 20, 2026 1mo ago
CVE-2026-8626	medium	6.1/10	SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter	May 20, 2026 1mo ago
CVE-2026-8627	medium	6.1/10	Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter	May 20, 2026 1mo ago
CVE-2026-8624	medium	6.1/10	LJ comments import: reloaded <= 0.97.1 - Reflected Cross-Site Scripting via PHP_SELF Parameter	May 20, 2026 1mo ago
CVE-2026-34216	medium	6.6/10	CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php	May 19, 2026 1mo ago
CVE-2026-26978	high	8.6/10	Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php	May 18, 2026 1mo ago
CVE-2025-65954	medium	4.7/10	SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout	May 18, 2026 1mo ago
CVE-2026-8803	medium	6.3/10	opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash	May 18, 2026 1mo ago
CVE-2026-8802	medium	5.3/10	opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal	May 18, 2026 1mo ago
CVE-2026-8785	medium	6.9/10	projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection	May 18, 2026 1mo ago