Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,509

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

694

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 871–900 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-4781	medium	5.3/10	SourceCodester Sales and Inventory System HTTP GET Parameter update_purchase.php sql injection	Mar 24, 2026 3mo ago
CVE-2026-4780	medium	5.3/10	SourceCodester Sales and Inventory System HTTP GET Parameter update_out_standing.php sql injection	Mar 24, 2026 3mo ago
CVE-2026-4779	medium	5.3/10	SourceCodester Sales and Inventory System HTTP GET Parameter update_customer_details.php sql injection	Mar 24, 2026 3mo ago
CVE-2026-4778	medium	5.3/10	SourceCodester Sales and Inventory System HTTP GET Parameter update_category.php sql injection	Mar 24, 2026 3mo ago
CVE-2026-4777	medium	5.3/10	SourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injection	Mar 24, 2026 3mo ago
CVE-2026-23923	medium	6.9/10	Unauthenticated arbitrary PHP class instantiation	Mar 24, 2026 3mo ago
CVE-2026-33401	high	7.1/10	Wallos: Incomplete fix for CVE-2026-30840 - SSRF in AI and notification endpoints bypass ssrf_helper.php	Mar 24, 2026 3mo ago
CVE-2019-25643	high	8.8/10	eNdonesia Portal v8.7 SQL Injection via banners.php	Mar 24, 2026 3mo ago
CVE-2019-25640	high	8.8/10	Inout Article Base CMS Lastest SQL Injection via portalLogin.php	Mar 24, 2026 3mo ago
CVE-2019-25638	high	7.1/10	Meeplace Business Review Script Lastest SQL Injection via addclick.php	Mar 24, 2026 3mo ago
CVE-2019-25632	medium	6.9/10	phpFileManager 1.7.8 Local File Inclusion via index.php	Mar 24, 2026 3mo ago
CVE-2026-4632	medium	6.9/10	itsourcecode Online Enrollment System Parameter index.php sql injection	Mar 24, 2026 3mo ago
CVE-2026-4626	medium	5.1/10	projectworlds Lawyer Management System lawyer_booking.php cross site scripting	Mar 24, 2026 3mo ago
CVE-2026-4625	medium	6.9/10	SourceCodester Online Admission System programmes.php sql injection	Mar 24, 2026 3mo ago
CVE-2026-4624	medium	6.9/10	SourceCodester Online Library Management System Parameter home.php sql injection	Mar 24, 2026 3mo ago
CVE-2026-4623	medium	6.9/10	DefaultFuction Jeson-Customer-Relationship-Management-System API Module System.php server-side request forgery	Mar 24, 2026 3mo ago
CVE-2026-4617	medium	6.9/10	SourceCodester Patients Waiting Area Queue Management System Patient Check-In api_patient_checkin.php ValidateToken improper authorization	Mar 24, 2026 3mo ago
CVE-2026-4615	medium	6.9/10	SourceCodester Online Catering Reservation search.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4614	medium	5.3/10	itsourcecode sanitize or validate this input Parameter subjects.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4613	medium	6.9/10	SourceCodester E-Commerce Site products.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4612	medium	6.9/10	itsourcecode Free Hotel Reservation System Parameter index.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4596	medium	5.1/10	projectworlds Lawyer Management System lawyers.php cross site scripting	Mar 23, 2026 3mo ago
CVE-2026-33723	high	7.1/10	AVideo Vulnerable to SQL Injection in Subscribe Endpoint via Unsanitized user_id Parameter in subscribe.php	Mar 23, 2026 3mo ago
CVE-2026-33719	high	8.6/10	AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php	Mar 23, 2026 3mo ago
CVE-2026-33717	high	8.8/10	AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort	Mar 23, 2026 3mo ago
CVE-2026-33716	critical	9.4/10	AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php	Mar 23, 2026 3mo ago
CVE-2026-33685	medium	5.3/10	AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data	Mar 23, 2026 3mo ago
CVE-2026-33681	high	7.2/10	AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name	Mar 23, 2026 3mo ago
CVE-2026-4595	medium	4.8/10	code-projects Exam Form Submission update_s6.php cross site scripting	Mar 23, 2026 3mo ago
CVE-2026-33649	high	8.1/10	AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification	Mar 23, 2026 3mo ago