Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,228

All time

Critical · Active

11,982

CVSS ≥ 9.0

New · 14 days

2,687

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 841–870 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-7075	medium	6.9/10	itsourcecode Construction Management System locations.php sql injection	Apr 27, 2026 3mo ago
CVE-2026-7074	medium	6.9/10	itsourcecode Construction Management System execute1.php sql injection	Apr 27, 2026 3mo ago
CVE-2026-7073	medium	6.9/10	itsourcecode Construction Management System execute.php sql injection	Apr 27, 2026 4mo ago
CVE-2026-7072	medium	6.9/10	CodePanda Source canteen_management_system login.php sql injection	Apr 27, 2026 4mo ago
CVE-2026-7063	medium	6.9/10	code-projects Employee Management System Endpoint eprocess.php sql injection	Apr 26, 2026 4mo ago
CVE-2026-7044	medium	5.3/10	GreenCMS index.php themeadd unrestricted upload	Apr 26, 2026 4mo ago
CVE-2026-7043	medium	5.3/10	GreenCMS index.php pluginAddLocal unrestricted upload	Apr 26, 2026 4mo ago
CVE-2026-7028	medium	5.1/10	CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection	Apr 26, 2026 4mo ago
CVE-2026-7025	medium	6.9/10	Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side request forgery	Apr 26, 2026 4mo ago
CVE-2026-7002	medium	6.9/10	KLiK SocialMediaWebsite Private Message get_message_ajax.php sql injection	Apr 25, 2026 4mo ago
CVE-2026-6982	medium	5.3/10	star7th ShowDoc API Page Sort Endpoint PageController.class.PHP sql injection	Apr 25, 2026 4mo ago
CVE-2026-41229	critical	9.1/10	Froxlor has a PHP Code Injection via Unescaped Single Quotes in userdata.inc.php Generation (MysqlServer API)	Apr 23, 2026 4mo ago
CVE-2026-34413	high	8.8/10	Xerte Online Toolkits Missing Authentication via connector.php	Apr 22, 2026 4mo ago
CVE-2026-34414	high	7.1/10	Xerte Online Toolkits Path Traversal via connector.php	Apr 22, 2026 4mo ago
CVE-2018-25270	critical	9.3/10	ThinkPHP 5.0.23 Remote Code Execution via invokefunction	Apr 22, 2026 4mo ago
CVE-2026-4119	critical	9.1/10	Create DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php	Apr 22, 2026 4mo ago
CVE-2026-41057	high	7.1/10	AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) that Exposes Authenticated API Responses	Apr 21, 2026 4mo ago
CVE-2026-40929	medium	5.4/10	WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators	Apr 21, 2026 4mo ago
CVE-2026-40925	high	8.3/10	WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeover Including Encoder URL and SMTP Credentials	Apr 21, 2026 4mo ago
CVE-2026-40909	high	8.7/10	WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE)	Apr 21, 2026 4mo ago
CVE-2026-40908	medium	5.3/10	WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes Developer Emails and Deployed Version	Apr 21, 2026 4mo ago
CVE-2026-40907	medium	6.5/10	WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys and OAuth Tokens	Apr 21, 2026 4mo ago
CVE-2025-41011	medium	5.1/10	HTML injection in PHP Point Of Sale	Apr 21, 2026 4mo ago
CVE-2026-39467	high	7.2/10	WordPress Responsive Slider by MetaSlider plugin <= 3.106.0 - PHP Object Injection vulnerability	Apr 21, 2026 4mo ago
CVE-2026-6652	medium	5.1/10	Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection	Apr 20, 2026 4mo ago
CVE-2026-6650	medium	5.1/10	Z-BlogPHP ZBA File app_upload.php UnPack unrestricted upload	Apr 20, 2026 4mo ago
CVE-2026-6633	medium	5.1/10	Yifang CMS Extended Management L_rbac_admin.php store cross site scripting	Apr 20, 2026 4mo ago
CVE-2026-6602	medium	6.9/10	rickxy Hospital Management System his_admin_account.php unrestricted upload	Apr 20, 2026 4mo ago
CVE-2026-6595	medium	6.9/10	ProjectsAndPrograms School Management System HTTP GET Parameter buslocation.php sql injection	Apr 20, 2026 4mo ago
CVE-2026-6573	medium	5.3/10	PHPEMS Instant Exam Creation exams.master.php temppage server-side request forgery	Apr 19, 2026 4mo ago