Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,228

All time

Critical · Active

11,982

CVSS ≥ 9.0

New · 14 days

2,687

Newly disclosed

Feed last synced

3 hrs ago

Data freshness

Showing 871–900 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-6572	medium	6.3/10	Collabora KodExplorer fileUpload Endpoint share.class.php improper authorization	Apr 19, 2026 4mo ago
CVE-2026-6571	medium	5.3/10	kodcloud KodExplorer systemRole.class.php roleGroupAction authorization	Apr 19, 2026 4mo ago
CVE-2026-6570	medium	5.1/10	kodcloud KodExplorer systemMember.class.php initInstall authorization	Apr 19, 2026 4mo ago
CVE-2026-6569	medium	6.9/10	kodcloud KodExplorer fileGet Endpoint share.class.php improper authentication	Apr 19, 2026 4mo ago
CVE-2026-6568	medium	6.9/10	kodcloud KodExplorer Public Share share.class.php initShareOld path traversal	Apr 19, 2026 4mo ago
CVE-2026-6561	medium	5.1/10	EyouCMS Index.php edit_adminlogo unrestricted upload	Apr 19, 2026 4mo ago
CVE-2026-40593	medium	4.8/10	ChurchCRM: Stored XSS in UserEditor.php via Login Name Field	Apr 18, 2026 4mo ago
CVE-2026-40581	high	8.1/10	ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion	Apr 17, 2026 4mo ago
CVE-2026-40484	critical	9.1/10	ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function	Apr 17, 2026 4mo ago
CVE-2026-40483	medium	5.4/10	ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field	Apr 17, 2026 4mo ago
CVE-2026-40476	medium	6.9/10	graphql-php: Denial of Service via quadratic complexity in OverlappingFieldsCanBeMerged validation	Apr 17, 2026 4mo ago
CVE-2026-40285	high	8.8/10	WeGIA has SQL Injection via Session Variable Override in DespachoControle.php	Apr 17, 2026 4mo ago
CVE-2026-40284	medium	6.8/10	WeGIA has stored XSS in listar_despachos.php	Apr 17, 2026 4mo ago
CVE-2026-40282	medium	6.4/10	WeGIA has stored XSS in intercorrencia_visualizar.php	Apr 17, 2026 4mo ago
CVE-2026-40283	medium	6.8/10	WeGIA has stored XSS in profile_paciente.php	Apr 17, 2026 4mo ago
CVE-2026-6497	medium	5.3/10	prasathmani TinyFileManager File Upload filemanager.php server-side request forgery	Apr 17, 2026 4mo ago
CVE-2026-6496	medium	5.3/10	prasathmani TinyFileManager POST Parameter filemanager.php path traversal	Apr 17, 2026 4mo ago
CVE-2026-6490	medium	6.9/10	QueryMine sms GET Request Parameter deletecourse.php sql injection	Apr 17, 2026 4mo ago
CVE-2026-6489	medium	5.3/10	QueryMine sms Background Management addteacher.php unrestricted upload	Apr 17, 2026 4mo ago
CVE-2026-6488	medium	5.3/10	QueryMine sms GET Request Parameter editcourse.php sql injection	Apr 17, 2026 4mo ago
CVE-2026-6487	medium	5.3/10	Qihui jtbc5 CMS Code Endpoint manage.php path traversal	Apr 17, 2026 4mo ago
CVE-2026-6486	medium	5.1/10	classroombookings User Display Name layout.php read cross site scripting	Apr 17, 2026 4mo ago
CVE-2026-6409	high	7.1/10	Denial of Service (DoS) vulnerability exists in the Protobuf PHP library during the parsing of untrusted input	Apr 16, 2026 4mo ago
CVE-2026-31843	critical	10.0/10	goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution	Apr 16, 2026 4mo ago
CVE-2026-33715	high	7.2/10	Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action	Apr 14, 2026 4mo ago
CVE-2026-33714	high	7.1/10	Chamilo LMS has Authenticated SQL Injection in statistics.ajax.php users_active action (2.0 RC2)	Apr 14, 2026 4mo ago
CVE-2026-3017	high	7.2/10	Smart Post Show – Post Grid, Post Carousel & Slider, and List Category Posts <= 3.0.12 - Authenticated (Administrator+) PHP Object Injection	Apr 14, 2026 4mo ago
CVE-2026-6202	medium	5.3/10	code-projects Easy Blog Site post.php sql injection	Apr 13, 2026 4mo ago
CVE-2026-6201	medium	5.3/10	CodeAstro Online Job Portal Delete Job Posting job-delete.php access control	Apr 13, 2026 4mo ago
CVE-2026-6193	medium	6.9/10	PHPGurukul Daily Expense Tracking System register.php sql injection	Apr 13, 2026 4mo ago