Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,287

All time

Critical · Active

11,990

CVSS ≥ 9.0

New · 14 days

2,743

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1051–1080 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-5539	medium	5.3/10	code-projects Simple Laundry System Parameter modifymember.php cross site scripting	Apr 5, 2026 4mo ago
CVE-2026-5537	medium	5.3/10	halex CourseSEL HTTP GET Parameter IndexController.class.php check_sel sql injection	Apr 5, 2026 4mo ago
CVE-2026-5534	medium	6.9/10	itsourcecode Online Enrollment System Parameter index.php sql injection	Apr 5, 2026 4mo ago
CVE-2018-25248	medium	5.1/10	MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php	Apr 4, 2026 4mo ago
CVE-2026-34787	medium	6.5/10	Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter	Apr 3, 2026 4mo ago
CVE-2026-5484	medium	6.9/10	BookStackApp BookStack Chapter Export ExportFormatter.php chapterToMarkdown access control	Apr 3, 2026 4mo ago
CVE-2026-5472	medium	5.3/10	ProjectsAndPrograms School Management System Profile Picture settings.php unrestricted upload	Apr 3, 2026 4mo ago
CVE-2026-34838	critical	10.0/10	Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`	Apr 2, 2026 4mo ago
CVE-2026-5368	medium	6.9/10	projectworlds Car Rental Project Parameter login.php sql injection	Apr 2, 2026 4mo ago
CVE-2026-34974	medium	5.4/10	phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation	Apr 2, 2026 4mo ago
CVE-2026-34973	medium	6.9/10	phpMyFAQ has a LIKE Wildcard Injection in Search.php — Unescaped % and _ Metacharacters Enable Broad Content Disclosure	Apr 2, 2026 4mo ago
CVE-2026-34729	medium	6.1/10	phpMyFAQ: Stored XSS via Regex Bypass in Filter::removeAttributes()	Apr 2, 2026 4mo ago
CVE-2026-5344	medium	5.3/10	Textpattern XML-RPC TXP_RPCServer.php mt_uploadImage path traversal	Apr 2, 2026 4mo ago
CVE-2026-34728	high	8.7/10	phpMyFAQ: Path Traversal - Arbitrary File Deletion in MediaBrowserController	Apr 2, 2026 4mo ago
CVE-2026-32629	medium	5.4/10	phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor	Apr 2, 2026 4mo ago
CVE-2026-5334	medium	6.9/10	itsourcecode Online Enrollment System Parameter index.php sql injection	Apr 2, 2026 4mo ago
CVE-2026-5333	medium	6.9/10	DefaultFuction Content-Management-System tools.php command injection	Apr 2, 2026 4mo ago
CVE-2026-5332	medium	5.1/10	Xiaopi Panel WAF Firewall demo.php cross site scripting	Apr 2, 2026 4mo ago
CVE-2026-5331	medium	5.1/10	OpenCart Extension Installer installer.php path traversal	Apr 2, 2026 4mo ago
CVE-2026-5330	medium	6.9/10	SourceCodester/mayuri_k Best Courier Management System User Delete ajax.php access control	Apr 2, 2026 4mo ago
CVE-2026-5326	medium	6.9/10	SourceCodester Leave Application System User Information index.php authorization	Apr 2, 2026 4mo ago
CVE-2026-5325	medium	5.1/10	SourceCodester Simple Customer Relationship Management System Create Ticket create-ticket.php cross site scripting	Apr 2, 2026 4mo ago
CVE-2026-5319	medium	5.3/10	itsourcecode Payroll Management System navbar.php cross site scripting	Apr 2, 2026 4mo ago
CVE-2026-34236	high	8.2/10	Auth0 PHP SDK Insufficient Entropy in Cookie Encryption	Apr 1, 2026 4mo ago
CVE-2026-29014	critical	9.3/10	MetInfo CMS Unauthenticated PHP Code Injection RCE	Apr 1, 2026 4mo ago
CVE-2026-5257	medium	6.9/10	code-projects Simple Laundry System Parameter delstaffinfo.php sql injection	Apr 1, 2026 4mo ago
CVE-2026-5256	medium	6.9/10	code-projects Simple Laundry System Parameter modify.php sql injection	Apr 1, 2026 4mo ago
CVE-2026-5255	medium	5.3/10	code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting	Apr 1, 2026 4mo ago
CVE-2026-5248	medium	5.3/10	gougucms User Registration Login.php reg_submit dynamically-determined object attributes	Apr 1, 2026 4mo ago
CVE-2026-5240	medium	5.3/10	code-projects BloodBank Managing System admin_state.php cross site scripting	Mar 31, 2026 4mo ago