Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,282

All time

Critical · Active

11,988

CVSS ≥ 9.0

New · 14 days

2,739

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 961–990 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-5814	medium	6.9/10	PHPGurukul Online Course Registration check_availability.php sql injection	Apr 8, 2026 4mo ago
CVE-2026-5813	medium	6.9/10	PHPGurukul Online Course Registration check_availability.php sql injection	Apr 8, 2026 4mo ago
CVE-2026-5812	medium	5.3/10	SourceCodester Pharmacy Product Management System POST Parameter add-sales.php logic error	Apr 8, 2026 4mo ago
CVE-2026-5811	medium	5.3/10	SourceCodester Online Food Ordering System POST Parameter Actions.php save_product logic error	Apr 8, 2026 4mo ago
CVE-2026-5810	medium	5.1/10	SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting	Apr 8, 2026 4mo ago
CVE-2026-5806	medium	5.1/10	code-projects Easy Blog Site update.php cross site scripting	Apr 8, 2026 4mo ago
CVE-2026-5805	medium	6.9/10	code-projects Easy Blog Site contact_us.php sql injection	Apr 8, 2026 4mo ago
CVE-2026-35023	medium	5.3/10	Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php	Apr 8, 2026 4mo ago
CVE-2026-3296	critical	9.8/10	Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata	Apr 8, 2026 4mo ago
CVE-2026-39366	medium	6.5/10	WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php	Apr 7, 2026 4mo ago
CVE-2026-39319	high	8.8/10	ChurchCRM has a Second Order SQLI via FundRaiserEditor.php	Apr 7, 2026 4mo ago
CVE-2026-39342	critical	9.4/10	ChurchCRM has a SQL injection searchwhat parameter via QueryView.php	Apr 7, 2026 4mo ago
CVE-2026-39340	high	8.1/10	ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution	Apr 7, 2026 4mo ago
CVE-2026-39334	high	8.8/10	ChurchCRM has a Blind SQL injection in SettingsIndividual.php	Apr 7, 2026 4mo ago
CVE-2026-39333	high	8.7/10	ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php	Apr 7, 2026 4mo ago
CVE-2026-39332	high	8.7/10	ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php	Apr 7, 2026 4mo ago
CVE-2026-39330	high	8.8/10	ChurchCRM has a Blind SQL injection in PropertyAssign.php	Apr 7, 2026 4mo ago
CVE-2026-39329	high	8.8/10	ChurchCRM has a Blind SQL injection in EventNames.php	Apr 7, 2026 4mo ago
CVE-2026-39327	high	8.8/10	ChurchCRM has a SQL injection in MemberRoleChange.php	Apr 7, 2026 4mo ago
CVE-2026-39326	high	8.8/10	ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php	Apr 7, 2026 4mo ago
CVE-2026-39325	high	7.2/10	ChurchCRM has a Blind SQL injection in SettingsUser.php	Apr 7, 2026 4mo ago
CVE-2026-39318	high	8.8/10	ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php	Apr 7, 2026 4mo ago
CVE-2026-35576	high	8.7/10	ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php	Apr 7, 2026 4mo ago
CVE-2026-35534	high	7.6/10	ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection	Apr 7, 2026 4mo ago
CVE-2021-4473	critical	9.3/10	Tianxin Internet Behavior Management System Command Injection via toQuery.php	Apr 7, 2026 4mo ago
CVE-2026-5719	medium	5.3/10	itsourcecode Construction Management System borrowedtool.php sql injection	Apr 7, 2026 4mo ago
CVE-2026-5705	medium	5.3/10	code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting	Apr 6, 2026 4mo ago
CVE-2026-35452	medium	5.3/10	WWBN AVideo has Unauthenticated Information Disclosure via Missing Auth on CloneSite client.log.php	Apr 6, 2026 4mo ago
CVE-2026-35450	medium	5.3/10	WWBN AVideo has Unauthenticated FFmpeg Remote Server Status Disclosure via check.ffmpeg.json.php	Apr 6, 2026 4mo ago
CVE-2026-35449	medium	5.3/10	WWBN AVideo has Unauthenticated Information Disclosure via Disabled CLI Guard in install/test.php	Apr 6, 2026 4mo ago