Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,510

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

626

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 901–930 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-33513	high	8.6/10	AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)	Mar 23, 2026 3mo ago
CVE-2026-33502	critical	9.3/10	AVideo has Unauthenticated SSRF via plugin/Live/test.php	Mar 23, 2026 3mo ago
CVE-2026-33499	medium	6.1/10	AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php	Mar 23, 2026 3mo ago
CVE-2026-4592	medium	6.3/10	kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication	Mar 23, 2026 3mo ago
CVE-2026-33493	high	7.1/10	AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter	Mar 23, 2026 3mo ago
CVE-2026-33492	high	7.3/10	AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration	Mar 23, 2026 3mo ago
CVE-2026-4591	medium	5.1/10	kalcaddle kodbox fileThumb Endpoint app.php checkBin os command injection	Mar 23, 2026 3mo ago
CVE-2026-4590	low	2.3/10	kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery	Mar 23, 2026 3mo ago
CVE-2026-33483	high	7.5/10	AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php	Mar 23, 2026 3mo ago
CVE-2026-33479	high	8.8/10	AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin	Mar 23, 2026 3mo ago
CVE-2026-33354	high	7.6/10	AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`	Mar 23, 2026 3mo ago
CVE-2026-33351	critical	9.1/10	AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass	Mar 23, 2026 3mo ago
CVE-2026-33297	medium	5.1/10	AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php	Mar 23, 2026 3mo ago
CVE-2026-4589	medium	5.3/10	kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery	Mar 23, 2026 3mo ago
CVE-2026-4588	medium	6.3/10	kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key	Mar 23, 2026 3mo ago
CVE-2026-4587	medium	6.3/10	HybridAuth SSL Curl.php certificate validation	Mar 23, 2026 3mo ago
CVE-2026-4581	medium	6.9/10	code-projects Simple Laundry System Parameters checklogin.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4580	medium	6.9/10	code-projects Simple Laundry System Parameters checkupdatestatus.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4579	medium	6.9/10	code-projects Simple Laundry System Parameters viewdetail.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4578	medium	4.8/10	code-projects Exam Form Submission update_s3.php cross site scripting	Mar 23, 2026 3mo ago
CVE-2026-4577	medium	4.8/10	code-projects Exam Form Submission update_s4.php cross site scripting	Mar 23, 2026 3mo ago
CVE-2026-4576	medium	4.8/10	code-projects Exam Form Submission update_s5.php cross site scripting	Mar 23, 2026 3mo ago
CVE-2026-4575	medium	4.8/10	code-projects Exam Form Submission update_s2.php cross site scripting	Mar 23, 2026 3mo ago
CVE-2026-4573	medium	5.3/10	SourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4572	medium	5.3/10	SourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4571	medium	5.3/10	SourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4570	medium	5.3/10	SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4569	medium	5.3/10	SourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4568	medium	5.3/10	SourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injection	Mar 23, 2026 3mo ago
CVE-2026-4563	medium	5.3/10	MacCMS Member Order Detail User.php order_info authorization	Mar 22, 2026 3mo ago