Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,163

All time

Critical · Active

11,974

CVSS ≥ 9.0

New · 14 days

2,675

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 331–360 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-49954	high	8.6/10	Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory	Jun 15, 2026 2mo ago
CVE-2026-49952	critical	9.3/10	Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle	Jun 15, 2026 2mo ago
CVE-2016-20082	medium	6.9/10	WordPress Plugin Abtest Local File Inclusion via abtest_admin.php	Jun 15, 2026 2mo ago
CVE-2016-20080	medium	6.9/10	WordPress Brandfolder Plugin 3.0 Local File Inclusion via callback.php	Jun 15, 2026 2mo ago
CVE-2016-20079	medium	6.9/10	WordPress Dharma Booking 2.28.3 Local File Inclusion via proccess.php	Jun 15, 2026 2mo ago
CVE-2016-20078	medium	6.9/10	WordPress IMDb Profile Widget 1.0.8 Local File Inclusion via pic.php	Jun 15, 2026 2mo ago
CVE-2016-20077	medium	6.9/10	WordPress Plugin Photocart Link 1.6 Local File Inclusion via decode.php	Jun 15, 2026 2mo ago
CVE-2016-20073	high	8.8/10	Answer My Question 1.3 Plugin WordPress SQL Injection via modal.php	Jun 15, 2026 2mo ago
CVE-2026-12207	medium	5.3/10	medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection	Jun 15, 2026 2mo ago
CVE-2026-12204	medium	6.9/10	ShopXO Scheduled Task Endpoint Crontab.php GoodsGiveIntegral authorization	Jun 15, 2026 2mo ago
CVE-2026-12176	medium	5.3/10	SourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scripting	Jun 13, 2026 2mo ago
CVE-2026-12175	medium	5.1/10	CodeAstro Student Attendance Management System createStudents.php sql injection	Jun 13, 2026 2mo ago
CVE-2026-12183	critical	9.3/10	Nefteprodukttekhnika BUK TS-G Gas Station Automation System Authentication Bypass via ajax-login.php Accepting Arbitrary Credentials	Jun 13, 2026 2mo ago
CVE-2026-12131	medium	5.3/10	CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection	Jun 12, 2026 2mo ago
CVE-2026-54133	critical	9.8/10	jmespath.php has CompilerRuntime code injection via unescaped function names	Jun 12, 2026 2mo ago
CVE-2026-12066	medium	6.9/10	PbootCMS Password MemberController.php retrieve password recovery	Jun 12, 2026 2mo ago
CVE-2026-45060	critical	9.8/10	ClipBucket: Blind SQL Injection in progress_video.php	Jun 11, 2026 2mo ago
CVE-2026-45418	high	8.8/10	ClipBucket: Blind SQL Injection in subtitle_edit.php	Jun 11, 2026 2mo ago
CVE-2026-45062	high	8.1/10	FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files	Jun 10, 2026 2mo ago
CVE-2026-10721	high	8.4/10	Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components	Jun 10, 2026 2mo ago
CVE-2026-46491	high	8.6/10	SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditional deletion	Jun 9, 2026 2mo ago
CVE-2026-34417	medium	5.1/10	OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php	Jun 9, 2026 2mo ago
CVE-2026-34416	medium	5.1/10	OSCAL-GUI Reflected XSS via project parameter in oscal.php	Jun 9, 2026 2mo ago
CVE-2026-25557	medium	5.1/10	Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter	Jun 9, 2026 2mo ago
CVE-2017-20251	critical	9.3/10	WordPress Insert PHP Plugin 4.7.0 PHP Code Injection via REST API	Jun 9, 2026 2mo ago
CVE-2026-8365	high	8.8/10	Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field	Jun 9, 2026 2mo ago
CVE-2026-11619	medium	5.3/10	Dolibarr ERP CRM Legacy Filemanager config.inc.php improper authorization	Jun 9, 2026 2mo ago
CVE-2026-11585	medium	5.3/10	CodeAstro Student Attendance Management System createClassArms.php sql injection	Jun 8, 2026 2mo ago
CVE-2026-11584	medium	5.3/10	CodeAstro Student Attendance Management System createClass.php edit sql injection	Jun 8, 2026 2mo ago
CVE-2026-11583	medium	5.3/10	CodeAstro Student Attendance Management System createClass.php sql injection	Jun 8, 2026 2mo ago