Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,126

All time

Critical · Active

11,967

CVSS ≥ 9.0

New · 14 days

2,707

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 91–120 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-67608	high	8.6/10	Telenia TVox 26.5.3 OS Command Injection via action_audio.php	Aug 3, 2026 20d ago
CVE-2026-64827	critical	9.3/10	Telenia TVox 26.5.3 Authentication Bypass via set_env.php	Aug 3, 2026 20d ago
CVE-2026-69094	medium	5.3/10	Admidio before 5.0.11 IDOR via save_temporary mylist_function.php	Aug 3, 2026 20d ago
CVE-2026-69091	high	8.7/10	Admidio before 5.0.11 Authentication Bypass via forum.php	Aug 3, 2026 20d ago
CVE-2026-18592	medium	5.1/10	osCommerce Email Template Configuration EmailController.php EmailController sql injection	Aug 3, 2026 21d ago
CVE-2025-15672	—	—	Chama < 1.0.13 - Unauthenticated PHP Object Injection	Aug 3, 2026 21d ago
CVE-2026-16062	—	—	Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content	Aug 2, 2026 22d ago
CVE-2026-53599	high	7.5/10	Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers	Jul 31, 2026 23d ago
CVE-2026-67350	low	2.1/10	Serendipity < 2.6.1 Open Redirect via exit.php	Jul 31, 2026 23d ago
CVE-2026-46594	medium	5.1/10	Reflected XSS in PHP Poll Script	Jul 31, 2026 23d ago
CVE-2026-46593	high	8.6/10	Authenticated SQL Injection in PHP Poll Script	Jul 31, 2026 23d ago
CVE-2025-67651	medium	6.9/10	CSRF in PHP Jabbers scripts	Jul 31, 2026 23d ago
CVE-2025-67650	high	8.6/10	Authenticated SQL Injection in PHP Jabbers scripts	Jul 31, 2026 23d ago
CVE-2025-67649	critical	9.3/10	Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script	Jul 31, 2026 23d ago
CVE-2026-12720	—	—	Kirki < 6.0.13 - Unauthenticated PHP Object Injection	Jul 31, 2026 24d ago
CVE-2026-14602	—	—	Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter	Jul 30, 2026 25d ago
CVE-2026-16610	critical	9.8/10	Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row Key	Jul 30, 2026 25d ago
CVE-2026-67595	critical	9.2/10	VaahCMS 2.0.0 - 2.3.4 Malicious JavaScript Supply Chain via security-otp.blade.php	Jul 29, 2026 25d ago
CVE-2026-59933	high	7.5/10	PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion	Jul 28, 2026 26d ago
CVE-2026-59931	high	7.7/10	PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist	Jul 28, 2026 26d ago
CVE-2026-49332	high	8.5/10	Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams	Jul 28, 2026 26d ago
CVE-2026-66399	high	8.5/10	phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership	Jul 27, 2026 27d ago
CVE-2026-66398	critical	9.4/10	phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API	Jul 27, 2026 27d ago
CVE-2026-66397	high	8.6/10	phpMyFAQ before 4.1.6 Path Traversal via category image deletion	Jul 27, 2026 27d ago
CVE-2026-61511	critical	9.3/10	vBulletin < 6.2.2 Eval Injection RCE via vb5/template/runtime.php	Jul 27, 2026 27d ago
CVE-2026-15962	high	8.8/10	Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field	Jul 26, 2026 29d ago
CVE-2026-16765	medium	6.9/10	CodeAstro Online Classroom loginlinkadmin.php sql injection	Jul 23, 2026 1mo ago
CVE-2026-65497	high	7.2/10	WordPress Complianz plugin <= 7.5.0 - PHP Object Injection vulnerability	Jul 23, 2026 1mo ago
CVE-2026-65493	high	7.5/10	WordPress Dokan Pro plugin <= 5.0.2 - PHP Object Injection vulnerability	Jul 23, 2026 1mo ago
CVE-2026-59544	critical	9.8/10	WordPress Thrive Quiz Builder plugin <= 10.9.3.0 - PHP Object Injection vulnerability	Jul 23, 2026 1mo ago