Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

701

Newly disclosed

Feed last synced

18 hrs ago

Data freshness

Showing 361–390 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2018-25331	medium	5.1/10	Zenar Content Management System Cross-Site Scripting via ajax.php	May 17, 2026 1mo ago
CVE-2018-25326	high	8.7/10	Google Drive for WordPress 2.2 Path Traversal RCE via gdrive-ajaxs.php	May 17, 2026 1mo ago
CVE-2018-25319	high	7.1/10	Redaxo CMS Addon MyEvents 2.2.1 SQL Injection via event_add.php	May 17, 2026 1mo ago
CVE-2026-8753	medium	5.3/10	kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection	May 17, 2026 1mo ago
CVE-2026-8747	medium	5.3/10	Z-BlogPHP Commend Approval c_system_event.php CheckComment improper authorization	May 17, 2026 1mo ago
CVE-2026-46367	high	7.6/10	phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering	May 15, 2026 1mo ago
CVE-2026-46366	high	7.5/10	phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass	May 15, 2026 1mo ago
CVE-2026-46365	medium	5.4/10	phpMyFAQ - Missing Authorization in Tag Deletion Endpoint	May 15, 2026 1mo ago
CVE-2026-46364	critical	9.8/10	phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha	May 15, 2026 1mo ago
CVE-2026-46363	medium	5.4/10	phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass	May 15, 2026 1mo ago
CVE-2026-46362	medium	6.5/10	phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check	May 15, 2026 1mo ago
CVE-2026-46361	medium	6.9/10	phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig	May 15, 2026 1mo ago
CVE-2026-46360	medium	5.4/10	phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer	May 15, 2026 1mo ago
CVE-2026-46359	high	7.5/10	phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields	May 15, 2026 1mo ago
CVE-2026-45010	critical	9.1/10	phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint	May 15, 2026 1mo ago
CVE-2026-45009	medium	4.3/10	phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints	May 15, 2026 1mo ago
CVE-2026-45008	medium	6.5/10	phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter	May 15, 2026 1mo ago
CVE-2026-45007	medium	4.3/10	phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure	May 15, 2026 1mo ago
CVE-2026-6811	medium	6.0/10	PHP Stack Exhaustion	May 14, 2026 1mo ago
CVE-2026-42552	high	7.5/10	Flight: Sensitive information disclosure via default error handler in flightphp/core	May 13, 2026 1mo ago
CVE-2026-42551	high	7.5/10	Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core	May 13, 2026 1mo ago
CVE-2020-37222	medium	5.1/10	Kuicms Php EE 2.0 Persistent Cross-Site Scripting via bbs reply	May 13, 2026 1mo ago
CVE-2020-37219	high	8.7/10	Joomla com_fabrik 3.9.11 Directory Traversal via image.php	May 13, 2026 1mo ago
CVE-2020-37218	high	8.8/10	Joomla com_hdwplayer 4.2 SQL Injection via search.php	May 13, 2026 1mo ago
CVE-2020-37217	medium	5.1/10	Easy2Pilot 7 Cross-Site Request Forgery via admin.php	May 13, 2026 1mo ago
CVE-2026-7635	high	8.1/10	coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field	May 13, 2026 1mo ago
CVE-2026-44548	high	8.1/10	ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)	May 12, 2026 1mo ago
CVE-2026-40863	high	7.5/10	PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader	May 12, 2026 1mo ago
CVE-2026-40902	high	7.5/10	PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions	May 12, 2026 1mo ago
CVE-2026-44167	high	7.5/10	phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()	May 12, 2026 1mo ago