Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,508

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

701

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 811–840 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-33759	medium	5.3/10	AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents	Mar 27, 2026 3mo ago
CVE-2026-4909	medium	4.8/10	code-projects Exam Form Submission update_s7.php cross site scripting	Mar 27, 2026 3mo ago
CVE-2026-4908	medium	6.9/10	code-projects Simple Laundry System Parameter modstaffinfo.php sql injection	Mar 27, 2026 3mo ago
CVE-2026-4899	medium	4.8/10	code-projects Online Food Ordering System food.php cross site scripting	Mar 26, 2026 3mo ago
CVE-2026-4898	medium	5.3/10	code-projects Online Food Ordering System contact.php cross site scripting	Mar 26, 2026 3mo ago
CVE-2026-33477	medium	4.3/10	FileRise has incorrect authorization in /api/file/snippet.php allows read_own users to read other users’ file content	Mar 26, 2026 3mo ago
CVE-2026-4877	medium	5.3/10	itsourcecode Payroll Management System index.php cross site scripting	Mar 26, 2026 3mo ago
CVE-2026-4876	medium	5.3/10	itsourcecode Free Hotel Reservation System index.php sql injection	Mar 26, 2026 3mo ago
CVE-2026-4875	medium	5.1/10	itsourcecode Free Hotel Reservation System index.php unrestricted upload	Mar 26, 2026 3mo ago
CVE-2018-25206	high	8.8/10	KomSeo Cart 1.3 SQL Injection via edit.php	Mar 26, 2026 3mo ago
CVE-2026-4850	medium	6.9/10	code-projects Simple Laundry System Parameter checkregisitem.php sql injection	Mar 26, 2026 3mo ago
CVE-2026-4849	medium	5.3/10	code-projects Simple Laundry System Parameter modify.php cross site scripting	Mar 26, 2026 3mo ago
CVE-2026-4844	medium	6.9/10	code-projects Online Food Ordering System Admin Login admin.php sql injection	Mar 26, 2026 3mo ago
CVE-2026-4842	medium	6.9/10	itsourcecode Online Enrollment System Parameter index.php sql injection	Mar 26, 2026 3mo ago
CVE-2026-4841	medium	6.9/10	code-projects Online Food Ordering System Shopping Cart cart.php sql injection	Mar 26, 2026 3mo ago
CVE-2026-4839	medium	6.9/10	SourceCodester Food Ordering System Parameter purchase.php sql injection	Mar 26, 2026 3mo ago
CVE-2026-4838	medium	6.9/10	SourceCodester Malawi Online Market display.php sql injection	Mar 26, 2026 3mo ago
CVE-2026-3328	high	7.2/10	Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts	Mar 26, 2026 3mo ago
CVE-2026-4836	medium	5.3/10	code-projects Accounting System delete.php sql injection	Mar 26, 2026 3mo ago
CVE-2026-4835	medium	5.1/10	code-projects Accounting System Web Application add_costumer.php cross site scripting	Mar 26, 2026 3mo ago
CVE-2026-4831	medium	6.3/10	kalcaddle kodbox Password-protected Share auth.class.php can improper authentication	Mar 26, 2026 3mo ago
CVE-2026-4830	medium	6.3/10	kalcaddle kodbox Public Share userShare.class.php add privilege escalation	Mar 26, 2026 3mo ago
CVE-2026-33934	medium	4.3/10	OpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures	Mar 25, 2026 3mo ago
CVE-2026-4826	medium	5.3/10	SourceCodester Sales and Inventory System HTTP GET Parameter update_stock.php sql injection	Mar 25, 2026 3mo ago
CVE-2026-33912	medium	5.4/10	OpenEMR has reflected XSS in ajax_download.php via reportID parameter	Mar 25, 2026 3mo ago
CVE-2026-33911	medium	5.4/10	OpenEMR vulnerable to reflected XSS in graphs.php via title parameter	Mar 25, 2026 3mo ago
CVE-2026-4825	medium	5.3/10	SourceCodester Sales and Inventory System HTTP GET Parameter update_sales.php sql injection	Mar 25, 2026 3mo ago
CVE-2026-29187	high	8.1/10	OpenEMR Vulnerable to Authenticated Blind Boolean-Based SQL Injection in new_search_popup.php	Mar 25, 2026 3mo ago
CVE-2026-32513	high	8.8/10	WordPress JS Archive List plugin <= 6.1.7 - PHP Object Injection vulnerability	Mar 25, 2026 3mo ago
CVE-2026-32512	critical	9.8/10	WordPress Pelicula theme < 1.10 - PHP Object Injection vulnerability	Mar 25, 2026 3mo ago