Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,226

All time

Critical · Active

11,982

CVSS ≥ 9.0

New · 14 days

2,693

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 691–720 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2020-37218	high	8.8/10	Joomla com_hdwplayer 4.2 SQL Injection via search.php	May 13, 2026 3mo ago
CVE-2020-37217	medium	5.1/10	Easy2Pilot 7 Cross-Site Request Forgery via admin.php	May 13, 2026 3mo ago
CVE-2026-7635	high	8.1/10	coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field	May 13, 2026 3mo ago
CVE-2026-44548	high	8.1/10	ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)	May 12, 2026 3mo ago
CVE-2026-40863	high	7.5/10	PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader	May 12, 2026 3mo ago
CVE-2026-40902	high	7.5/10	PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions	May 12, 2026 3mo ago
CVE-2026-44167	high	7.5/10	phpseclib: CVE-2024-27355 mitigation bypass — OID amplification DoS in ASN1::decodeOID()	May 12, 2026 3mo ago
CVE-2026-43883	medium	4.2/10	WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements	May 11, 2026 3mo ago
CVE-2026-43882	medium	4.3/10	WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calendar Event Spoofing	May 11, 2026 3mo ago
CVE-2026-43881	medium	5.3/10	WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` Parameter Flips `$ignoreAdmin = true` and Defeats Admin-Only Listing Guard	May 11, 2026 3mo ago
CVE-2026-43880	medium	5.3/10	WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishing from Site's Legitimate From Address	May 11, 2026 3mo ago
CVE-2026-43878	medium	6.1/10	WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal	May 11, 2026 3mo ago
CVE-2026-43877	medium	5.4/10	WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User's Profile Photo with Arbitrary Bytes	May 11, 2026 3mo ago
CVE-2026-43876	medium	6.4/10	WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishing Emails to Channel Subscribers	May 11, 2026 3mo ago
CVE-2026-43873	high	7.5/10	WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server	May 11, 2026 3mo ago
CVE-2026-45026	medium	6.8/10	WeGIA: Stored XSS in html/atendido/processo_aceitacao.php	May 11, 2026 3mo ago
CVE-2026-45025	medium	6.8/10	WeGIA: Stored XSS in html/atendido/etapa_processo.php	May 11, 2026 3mo ago
CVE-2026-42872	medium	6.1/10	WeGIA: Reflected XSS in listar_arquivos_etapa.php	May 11, 2026 3mo ago
CVE-2026-42870	medium	6.4/10	WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'	May 11, 2026 3mo ago
CVE-2026-34089	low	2.3/10	Memory leak in Scribunto causes runJobs.php to run out of memory	May 11, 2026 3mo ago
CVE-2026-6433	—	—	Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE	May 11, 2026 3mo ago
CVE-2022-50959	medium	5.1/10	WordPress Contact Form Builder 1.6.1 Cross-Site Scripting via code_generator.php	May 10, 2026 3mo ago
CVE-2022-50958	medium	5.1/10	WordPress Plugin Jetpack 9.1 Cross Site Scripting via grunion-form-view.php	May 10, 2026 3mo ago
CVE-2022-50944	high	8.7/10	Aero CMS 0.0.1 PHP Code Injection via posts.php	May 10, 2026 3mo ago
CVE-2022-50943	medium	5.1/10	Moodle LMS 4.0 Cross-Site Scripting via course search.php	May 10, 2026 3mo ago
CVE-2026-8231	medium	5.3/10	CodeAstro Online Catering Ordering System deleteorder.php sql injection	May 10, 2026 3mo ago
CVE-2026-7259	low	2.1/10	Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()	May 10, 2026 3mo ago
CVE-2026-6735	high	7.3/10	XSS within PHP-FPM status endpoint	May 10, 2026 3mo ago
CVE-2026-8194	medium	5.3/10	osTicket Dispatcher class.dispatcher.php cross-site request forgery	May 9, 2026 3mo ago
CVE-2026-42569	critical	9.4/10	phpvms: /importer authorization bypass causing full database wipe	May 9, 2026 3mo ago