Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,226

All time

Critical · Active

11,982

CVSS ≥ 9.0

New · 14 days

2,693

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 661–690 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-34216	medium	6.6/10	CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php	May 19, 2026 3mo ago
CVE-2026-26978	high	8.6/10	Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php	May 18, 2026 3mo ago
CVE-2025-65954	medium	4.7/10	SimpleSAMLphp-casserver has an Open Redirect vulnerability via logout	May 18, 2026 3mo ago
CVE-2026-8803	medium	6.3/10	opensourcepos Open Source Point of Sale Employee Login Employee.php login weak hash	May 18, 2026 3mo ago
CVE-2026-8802	medium	5.3/10	opensourcepos Open Source Point of Sale Items.php getPicThumb path traversal	May 18, 2026 3mo ago
CVE-2026-8785	medium	6.9/10	projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection	May 18, 2026 3mo ago
CVE-2018-25331	medium	5.1/10	Zenar Content Management System Cross-Site Scripting via ajax.php	May 17, 2026 3mo ago
CVE-2018-25326	high	8.7/10	Google Drive for WordPress 2.2 Path Traversal RCE via gdrive-ajaxs.php	May 17, 2026 3mo ago
CVE-2018-25319	high	7.1/10	Redaxo CMS Addon MyEvents 2.2.1 SQL Injection via event_add.php	May 17, 2026 3mo ago
CVE-2026-8753	medium	5.3/10	kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection	May 17, 2026 3mo ago
CVE-2026-8747	medium	5.3/10	Z-BlogPHP Commend Approval c_system_event.php CheckComment improper authorization	May 17, 2026 3mo ago
CVE-2021-47956	high	8.8/10	EgavilanMedia PHPCRUD 1.0 SQL Injection via firstname	May 16, 2026 3mo ago
CVE-2026-46367	high	7.6/10	phpMyFAQ - Stored XSS via Utils::parseUrl() in Comment Rendering	May 15, 2026 3mo ago
CVE-2026-46366	high	7.5/10	phpMyFAQ - Unauthenticated Information Disclosure via getIdFromSolutionId Permission Bypass	May 15, 2026 3mo ago
CVE-2026-46365	medium	5.4/10	phpMyFAQ - Missing Authorization in Tag Deletion Endpoint	May 15, 2026 3mo ago
CVE-2026-46364	critical	9.8/10	phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha	May 15, 2026 3mo ago
CVE-2026-46363	medium	5.4/10	phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass	May 15, 2026 3mo ago
CVE-2026-46362	medium	6.5/10	phpMyFAQ - Authorization Bypass in Admin Pages via Non-Terminating Permission Check	May 15, 2026 3mo ago
CVE-2026-46361	medium	6.9/10	phpMyFAQ - Stored Cross-Site Scripting via raw Filter in search.twig	May 15, 2026 3mo ago
CVE-2026-46360	medium	5.4/10	phpMyFAQ - Stored XSS via Entity Decoding Depth Limit Bypass in SVG Sanitizer	May 15, 2026 3mo ago
CVE-2026-46359	high	7.5/10	phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth Token Fields	May 15, 2026 3mo ago
CVE-2026-45010	critical	9.1/10	phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint	May 15, 2026 3mo ago
CVE-2026-45009	medium	4.3/10	phpMyFAQ - Insufficient Authorization Check in Admin API Endpoints	May 15, 2026 3mo ago
CVE-2026-45008	medium	6.5/10	phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter	May 15, 2026 3mo ago
CVE-2026-45007	medium	4.3/10	phpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure	May 15, 2026 3mo ago
CVE-2026-6811	medium	6.0/10	PHP Stack Exhaustion	May 14, 2026 3mo ago
CVE-2026-42552	high	7.5/10	Flight: Sensitive information disclosure via default error handler in flightphp/core	May 13, 2026 3mo ago
CVE-2026-42551	high	7.5/10	Flight: HTTP method override enabled by default enables CSRF escalation and middleware bypass in flightphp/core	May 13, 2026 3mo ago
CVE-2020-37222	medium	5.1/10	Kuicms Php EE 2.0 Persistent Cross-Site Scripting via bbs reply	May 13, 2026 3mo ago
CVE-2020-37219	high	8.7/10	Joomla com_fabrik 3.9.11 Directory Traversal via image.php	May 13, 2026 3mo ago