Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

700

Newly disclosed

Feed last synced

19 hrs ago

Data freshness

Showing 391–420 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-43883	medium	4.2/10	WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements	May 11, 2026 1mo ago
CVE-2026-43882	medium	4.3/10	WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing	May 11, 2026 1mo ago
CVE-2026-43881	medium	5.3/10	WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard	May 11, 2026 1mo ago
CVE-2026-43880	medium	5.3/10	WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address	May 11, 2026 1mo ago
CVE-2026-43878	medium	6.1/10	WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal	May 11, 2026 1mo ago
CVE-2026-43877	medium	5.4/10	WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes	May 11, 2026 1mo ago
CVE-2026-43876	medium	6.4/10	WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers	May 11, 2026 1mo ago
CVE-2026-43873	high	7.5/10	WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server	May 11, 2026 1mo ago
CVE-2026-45026	medium	6.8/10	WeGIA: Stored XSS in html/atendido/processo_aceitacao.php	May 11, 2026 1mo ago
CVE-2026-45025	medium	6.8/10	WeGIA: Stored XSS in html/atendido/etapa_processo.php	May 11, 2026 1mo ago
CVE-2026-42872	medium	6.1/10	WeGIA: Reflected XSS in listar_arquivos_etapa.php	May 11, 2026 1mo ago
CVE-2026-42870	medium	6.4/10	WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'	May 11, 2026 1mo ago
CVE-2026-34089	low	2.3/10	Memory leak in Scribunto causes runJobs.php to run out of memory	May 11, 2026 1mo ago
CVE-2026-6433	—	—	Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE	May 11, 2026 1mo ago
CVE-2022-50959	medium	5.1/10	WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php	May 10, 2026 1mo ago
CVE-2022-50958	medium	5.1/10	WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php	May 10, 2026 1mo ago
CVE-2022-50944	high	8.7/10	Aero CMS 0.0.1 PHP Code Injection via posts.php	May 10, 2026 1mo ago
CVE-2022-50943	medium	5.1/10	Moodle LMS 4.0 Cross-Site Scripting via course search.php	May 10, 2026 1mo ago
CVE-2026-8231	medium	5.3/10	CodeAstro Online Catering Ordering System deleteorder.php sql injection	May 10, 2026 1mo ago
CVE-2026-7259	low	2.1/10	Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()	May 10, 2026 1mo ago
CVE-2026-6735	high	7.3/10	XSS within PHP-FPM status endpoint	May 10, 2026 1mo ago
CVE-2026-8194	medium	5.3/10	osTicket Dispatcher class.dispatcher.php cross-site request forgery	May 9, 2026 1mo ago
CVE-2026-42569	critical	9.4/10	phpvms: /importer authorization bypass causing full database wipe	May 9, 2026 1mo ago
CVE-2026-8193	medium	5.3/10	Akaunting Invoice PDF Rendering dompdf.php server-side request forgery	May 9, 2026 1mo ago
CVE-2026-42287	critical	10.0/10	Emlog: SQL Injection Vulnerability in log_model.php within addLog() and updateLog() Functions	May 8, 2026 1mo ago
CVE-2026-41570	high	7.8/10	PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes	May 8, 2026 1mo ago
CVE-2026-5127	high	8.8/10	User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection	May 8, 2026 1mo ago
CVE-2026-8136	medium	4.8/10	SourceCodester Pharmacy Sales and Inventory System index.php users cross site scripting	May 8, 2026 1mo ago
CVE-2026-8133	medium	6.9/10	zyx0814 FilePress Shares Filelist API admin.php sql injection	May 8, 2026 1mo ago
CVE-2026-8132	medium	6.9/10	CodeAstro Leave Management System login.php sql injection	May 8, 2026 1mo ago