Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,501

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

695

Newly disclosed

Feed last synced

9 hrs ago

Data freshness

Showing 751–780 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-34838	critical	10.0/10	Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`	Apr 2, 2026 2mo ago
CVE-2026-5368	medium	6.9/10	projectworlds Car Rental Project Parameter login.php sql injection	Apr 2, 2026 2mo ago
CVE-2026-34974	medium	5.4/10	phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation	Apr 2, 2026 2mo ago
CVE-2026-34973	medium	6.9/10	phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure	Apr 2, 2026 2mo ago
CVE-2026-34729	medium	6.1/10	phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()	Apr 2, 2026 2mo ago
CVE-2026-5344	medium	5.3/10	Textpattern XML-RPC TXP_RPCServer.php mt_uploadImage path traversal	Apr 2, 2026 2mo ago
CVE-2026-34728	high	8.7/10	phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController	Apr 2, 2026 2mo ago
CVE-2026-32629	medium	5.4/10	phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor	Apr 2, 2026 2mo ago
CVE-2026-5334	medium	6.9/10	itsourcecode Online Enrollment System Parameter index.php sql injection	Apr 2, 2026 2mo ago
CVE-2026-5333	medium	6.9/10	DefaultFuction Content-Management-System tools.php command injection	Apr 2, 2026 2mo ago
CVE-2026-5332	medium	5.1/10	Xiaopi Panel WAF Firewall demo.php cross site scripting	Apr 2, 2026 2mo ago
CVE-2026-5331	medium	5.1/10	OpenCart Extension Installer installer.php path traversal	Apr 2, 2026 2mo ago
CVE-2026-5330	medium	6.9/10	SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control	Apr 2, 2026 2mo ago
CVE-2026-5326	medium	6.9/10	SourceCodester Leave Application System User Information index.php authorization	Apr 2, 2026 2mo ago
CVE-2026-5325	medium	5.1/10	SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting	Apr 2, 2026 2mo ago
CVE-2026-5319	medium	5.3/10	itsourcecode Payroll Management System navbar.php cross site scripting	Apr 2, 2026 2mo ago
CVE-2026-34236	high	8.2/10	Auth0 PHP SDK Insufficient Entropy in Cookie Encryption	Apr 1, 2026 2mo ago
CVE-2026-29014	critical	9.3/10	MetInfo CMS Unauthenticated PHP Code Injection RCE	Apr 1, 2026 2mo ago
CVE-2026-5257	medium	6.9/10	code-projects Simple Laundry System Parameter delstaffinfo.php sql injection	Apr 1, 2026 2mo ago
CVE-2026-5256	medium	6.9/10	code-projects Simple Laundry System Parameter modify.php sql injection	Apr 1, 2026 2mo ago
CVE-2026-5255	medium	5.3/10	code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting	Apr 1, 2026 2mo ago
CVE-2026-5248	medium	5.3/10	gougucms User Registration Login.php reg_submit dynamically-determined object attributes	Apr 1, 2026 2mo ago
CVE-2026-5240	medium	5.3/10	code-projects BloodBank Managing System admin_state.php cross site scripting	Mar 31, 2026 2mo ago
CVE-2026-5238	medium	6.9/10	itsourcecode Payroll Management System Parameter view_employee.php sql injection	Mar 31, 2026 2mo ago
CVE-2026-5237	medium	6.9/10	itsourcecode Payroll Management System Parameter manage_user.php sql injection	Mar 31, 2026 2mo ago
CVE-2026-34739	medium	6.1/10	AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php	Mar 31, 2026 2mo ago
CVE-2026-34733	medium	6.5/10	AVideo: Unauthenticated File Deletion via PHP Operator Precedence Bug in CLI Guard	Mar 31, 2026 2mo ago
CVE-2026-34732	medium	5.3/10	AVideo: Missing Authentication in CreatePlugin list.json.php Template Affects 21 Endpoints	Mar 31, 2026 2mo ago
CVE-2026-34731	high	7.5/10	AVideo: Unauthenticated Live Stream Termination via RTMP Callback on_publish_done.php	Mar 31, 2026 2mo ago
CVE-2026-34611	medium	6.5/10	AVideo: CSRF on emailAllUsers.json.php Enables Mass Phishing Email to All Users	Mar 31, 2026 2mo ago