Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,501

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

699

Newly disclosed

Feed last synced

5 hrs ago

Data freshness

Showing 661–690 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-35023	medium	5.3/10	Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php	Apr 8, 2026 2mo ago
CVE-2026-3296	critical	9.8/10	Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata	Apr 8, 2026 2mo ago
CVE-2026-39366	medium	6.5/10	WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php	Apr 7, 2026 2mo ago
CVE-2026-39319	high	8.8/10	ChurchCRM has a Second Order SQLI via FundRaiserEditor.php	Apr 7, 2026 2mo ago
CVE-2026-39342	critical	9.4/10	ChurchCRM has a SQL injection searchwhat parameter via QueryView.php	Apr 7, 2026 2mo ago
CVE-2026-39340	high	8.1/10	ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution	Apr 7, 2026 2mo ago
CVE-2026-39334	high	8.8/10	ChurchCRM has a Blind SQL injection in SettingsIndividual.php	Apr 7, 2026 2mo ago
CVE-2026-39333	high	8.7/10	ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php	Apr 7, 2026 2mo ago
CVE-2026-39332	high	8.7/10	ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php	Apr 7, 2026 2mo ago
CVE-2026-39330	high	8.8/10	ChurchCRM has a Blind SQL injection in PropertyAssign.php	Apr 7, 2026 2mo ago
CVE-2026-39329	high	8.8/10	ChurchCRM has a Blind SQL injection in EventNames.php	Apr 7, 2026 2mo ago
CVE-2026-39327	high	8.8/10	ChurchCRM has a SQL injection in MemberRoleChange.php	Apr 7, 2026 2mo ago
CVE-2026-39326	high	8.8/10	ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php	Apr 7, 2026 2mo ago
CVE-2026-39325	high	7.2/10	ChurchCRM has a Blind SQL injection in SettingsUser.php	Apr 7, 2026 2mo ago
CVE-2026-39318	high	8.8/10	ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php	Apr 7, 2026 2mo ago
CVE-2026-35576	high	8.7/10	ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php	Apr 7, 2026 2mo ago
CVE-2026-35534	high	7.6/10	ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection	Apr 7, 2026 2mo ago
CVE-2021-4473	critical	9.3/10	Tianxin Internet Behavior Management System Command Injection via toQuery.php	Apr 7, 2026 2mo ago
CVE-2026-5719	medium	5.3/10	itsourcecode Construction Management System borrowedtool.php sql injection	Apr 7, 2026 2mo ago
CVE-2026-5705	medium	5.3/10	code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting	Apr 6, 2026 2mo ago
CVE-2026-35452	medium	5.3/10	WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php	Apr 6, 2026 2mo ago
CVE-2026-35450	medium	5.3/10	WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php	Apr 6, 2026 2mo ago
CVE-2026-35449	medium	5.3/10	WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php	Apr 6, 2026 2mo ago
CVE-2026-35448	low	3.7/10	WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php	Apr 6, 2026 2mo ago
CVE-2026-35395	high	8.8/10	WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter	Apr 6, 2026 2mo ago
CVE-2026-5681	medium	5.3/10	itsourcecode sanitize or validate this input Parameter borrowedequip.php sql injection	Apr 6, 2026 2mo ago
CVE-2026-35181	medium	4.3/10	WWBN AVideo Affected by CSRF on Player Skin Configuration via admin/playerUpdate.json.php	Apr 6, 2026 2mo ago
CVE-2026-35179	medium	5.3/10	WWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php	Apr 6, 2026 2mo ago
CVE-2026-5675	medium	5.3/10	itsourcecode Construction Management System Parameter borrowed_tool.php sql injection	Apr 6, 2026 2mo ago
CVE-2026-5672	medium	6.9/10	code-projects Simple IT Discussion Forum Parameter edit-category.php sql injection	Apr 6, 2026 2mo ago