Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,508

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

702

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 781–810 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-34395	medium	6.5/10	AVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php	Mar 31, 2026 2mo ago
CVE-2026-34382	medium	4.6/10	Admidio: Missing CSRF Protection on Custom List Deletion in mylist_function.php	Mar 31, 2026 2mo ago
CVE-2026-5203	medium	5.1/10	CMS Made Simple UserGuide Module XML Import class.UserGuideImporterExporter.php _copyFilesToFolder path traversal	Mar 31, 2026 2mo ago
CVE-2026-5198	medium	6.9/10	code-projects Student Membership System Admin Login index.php sql injection	Mar 31, 2026 2mo ago
CVE-2026-5197	medium	5.3/10	code-projects Student Membership System delete_user.php sql injection	Mar 31, 2026 2mo ago
CVE-2026-5196	medium	5.3/10	code-projects Student Membership System delete_member.php sql injection	Mar 31, 2026 2mo ago
CVE-2026-5181	medium	5.3/10	SourceCodester Simple Doctors Appointment System ajax.php unrestricted upload	Mar 31, 2026 2mo ago
CVE-2026-5180	medium	6.9/10	SourceCodester Simple Doctors Appointment System ajax.php sql injection	Mar 31, 2026 2mo ago
CVE-2026-5179	medium	6.9/10	SourceCodester Simple Doctors Appointment System login.php sql injection	Mar 31, 2026 2mo ago
CVE-2026-34036	medium	6.5/10	Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php	Mar 31, 2026 2mo ago
CVE-2026-5157	medium	5.3/10	code-projects Online Food Ordering System Order order.php cross site scripting	Mar 30, 2026 2mo ago
CVE-2026-5150	medium	6.9/10	code-projects Accounting System Parameter viewin_costumer.php sql injection	Mar 30, 2026 3mo ago
CVE-2026-5106	medium	4.8/10	code-projects Exam Form Submission update_fst.php cross site scripting	Mar 30, 2026 3mo ago
CVE-2026-5041	medium	5.1/10	code-projects Chamber of Commerce Membership Management System pageMail.php fwrite command injection	Mar 29, 2026 3mo ago
CVE-2026-5035	medium	6.9/10	code-projects Accounting System Parameter view_work.php sql injection	Mar 29, 2026 3mo ago
CVE-2026-5034	medium	6.9/10	code-projects Accounting System Parameter edit_costumer.php sql injection	Mar 29, 2026 3mo ago
CVE-2026-5033	medium	6.9/10	code-projects Accounting System Parameter view_costumer.php sql injection	Mar 29, 2026 3mo ago
CVE-2026-5019	medium	6.9/10	code-projects Simple Food Order System Parameter all-orders.php sql injection	Mar 28, 2026 3mo ago
CVE-2026-5018	medium	6.9/10	code-projects Simple Food Order System Parameter register-router.php sql injection	Mar 28, 2026 3mo ago
CVE-2026-5017	medium	6.9/10	code-projects Simple Food Order System Parameter all-tickets.php sql injection	Mar 28, 2026 3mo ago
CVE-2026-33991	high	8.8/10	WeGIA has SQL Injection in deletar_tag.php	Mar 27, 2026 3mo ago
CVE-2026-4973	medium	5.1/10	SourceCodester Online Quiz System add-question.php cross site scripting	Mar 27, 2026 3mo ago
CVE-2026-4972	medium	4.8/10	code-projects Online Reviewer System btn_functions.php cross site scripting	Mar 27, 2026 3mo ago
CVE-2026-4970	medium	5.3/10	code-projects Social Networking Site Endpoint delete_photos.php sql injection	Mar 27, 2026 3mo ago
CVE-2026-4969	medium	5.1/10	code-projects Social Networking Site Alert home.php cross site scripting	Mar 27, 2026 3mo ago
CVE-2026-34364	medium	5.3/10	AVideo has User Group-Based Category Access Control Bypass via Missing and Broken Group Filtering in categories.json.php	Mar 27, 2026 3mo ago
CVE-2026-4968	medium	5.3/10	SourceCodester Diary App diary.php cross-site request forgery	Mar 27, 2026 3mo ago
CVE-2026-4966	medium	5.3/10	itsourcecode Free Hotel Reservation System index.php sql injection	Mar 27, 2026 3mo ago
CVE-2026-34247	medium	5.4/10	AVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications	Mar 27, 2026 3mo ago
CVE-2026-33770	high	7.1/10	AVideo has SQL Injection in category.php fixCleanTitle() via Unparameterized clean_title and id Variables	Mar 27, 2026 3mo ago