Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,501

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

701

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 571–600 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-40593	medium	4.8/10	ChurchCRM: Stored XSS in UserEditor.php via Login Name Field	Apr 18, 2026 2mo ago
CVE-2026-40581	high	8.1/10	ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion	Apr 17, 2026 2mo ago
CVE-2026-40484	critical	9.1/10	ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function	Apr 17, 2026 2mo ago
CVE-2026-40483	medium	5.4/10	ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field	Apr 17, 2026 2mo ago
CVE-2026-40476	medium	6.9/10	graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation	Apr 17, 2026 2mo ago
CVE-2026-40285	high	8.8/10	WeGIA has SQL Injection via Session Variable Override in DespachoControle.php	Apr 17, 2026 2mo ago
CVE-2026-40284	medium	6.8/10	WeGIA has stored XSS in listar_despachos.php	Apr 17, 2026 2mo ago
CVE-2026-40282	medium	6.4/10	WeGIA has stored XSS in intercorrencia_visualizar.php	Apr 17, 2026 2mo ago
CVE-2026-40283	medium	6.8/10	WeGIA has stored XSS in profile_paciente.php	Apr 17, 2026 2mo ago
CVE-2026-6497	medium	5.3/10	prasathmani TinyFileManager File Upload filemanager.php server-side request forgery	Apr 17, 2026 2mo ago
CVE-2026-6496	medium	5.3/10	prasathmani TinyFileManager POST Parameter filemanager.php path traversal	Apr 17, 2026 2mo ago
CVE-2026-6490	medium	6.9/10	QueryMine sms GET Request Parameter deletecourse.php sql injection	Apr 17, 2026 2mo ago
CVE-2026-6489	medium	5.3/10	QueryMine sms Background Management addteacher.php unrestricted upload	Apr 17, 2026 2mo ago
CVE-2026-6488	medium	5.3/10	QueryMine sms GET Request Parameter editcourse.php sql injection	Apr 17, 2026 2mo ago
CVE-2026-6487	medium	5.3/10	Qihui jtbc5 CMS Code Endpoint manage.php path traversal	Apr 17, 2026 2mo ago
CVE-2026-6486	medium	5.1/10	classroombookings User Display Name layout.php read cross site scripting	Apr 17, 2026 2mo ago
CVE-2026-6409	high	7.1/10	Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input	Apr 16, 2026 2mo ago
CVE-2026-33715	high	7.2/10	Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action	Apr 14, 2026 2mo ago
CVE-2026-33714	high	7.1/10	Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)	Apr 14, 2026 2mo ago
CVE-2026-3017	high	7.2/10	Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection	Apr 14, 2026 2mo ago
CVE-2026-6202	medium	5.3/10	code-projects Easy Blog Site post.php sql injection	Apr 13, 2026 2mo ago
CVE-2026-6201	medium	5.3/10	CodeAstro Online Job Portal Delete Job Posting job-delete.php access control	Apr 13, 2026 2mo ago
CVE-2026-6193	medium	6.9/10	PHPGurukul Daily Expense Tracking System register.php sql injection	Apr 13, 2026 2mo ago
CVE-2026-39940	medium	5.3/10	ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php	Apr 13, 2026 2mo ago
CVE-2026-6191	medium	5.3/10	itsourcecode Construction Management System equipments.php sql injection	Apr 13, 2026 2mo ago
CVE-2026-6190	medium	5.3/10	itsourcecode Construction Management System employees.php sql injection	Apr 13, 2026 2mo ago
CVE-2026-6189	medium	6.9/10	SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection	Apr 13, 2026 2mo ago
CVE-2026-6188	medium	6.9/10	SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection	Apr 13, 2026 2mo ago
CVE-2026-6187	medium	6.9/10	SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection	Apr 13, 2026 2mo ago
CVE-2026-6184	medium	4.8/10	code-projects Simple Content Management System welcome.php cross site scripting	Apr 13, 2026 2mo ago