Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,295

All time

Critical · Active

12,000

CVSS ≥ 9.0

New · 14 days

2,722

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 1201–1230 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-33719	high	8.6/10	AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php	Mar 23, 2026 5mo ago
CVE-2026-33717	high	8.8/10	AVideo Vulnerable to Remote Code Execution via Persistent PHP Temp File in Encoder downloadURL with Resolution Validation Abort	Mar 23, 2026 5mo ago
CVE-2026-33716	critical	9.4/10	AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php	Mar 23, 2026 5mo ago
CVE-2026-33685	medium	5.3/10	AVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data	Mar 23, 2026 5mo ago
CVE-2026-33681	high	7.2/10	AVideo has Path Traversal in pluginRunDatabaseScript.json.php Enables Arbitrary SQL File Execution via Unsanitized Plugin Name	Mar 23, 2026 5mo ago
CVE-2026-4595	medium	4.8/10	code-projects Exam Form Submission update_s6.php cross site scripting	Mar 23, 2026 5mo ago
CVE-2026-33649	high	8.1/10	AVideo's GET-Based CSRF in setPermission.json.php Enables Privilege Escalation via Arbitrary Permission Modification	Mar 23, 2026 5mo ago
CVE-2026-33513	high	8.6/10	AVideo has an Unauthenticated Local File Inclusion in API locale (RCE possible with writable PHP)	Mar 23, 2026 5mo ago
CVE-2026-33502	critical	9.3/10	AVideo has Unauthenticated SSRF via plugin/Live/test.php	Mar 23, 2026 5mo ago
CVE-2026-33499	medium	6.1/10	AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php	Mar 23, 2026 5mo ago
CVE-2026-4592	medium	6.3/10	kalcaddle kodbox Password Login index.class.php tfaVerify improper authentication	Mar 23, 2026 5mo ago
CVE-2026-33493	high	7.1/10	AVideo has a Path Traversal in import.json.php that Allows Private Video Theft and Arbitrary File Read/Deletion via fileURI Parameter	Mar 23, 2026 5mo ago
CVE-2026-33492	high	7.3/10	AVideo has Session Fixation via GET PHPSESSID Parameter With Disabled Login Session Regeneration	Mar 23, 2026 5mo ago
CVE-2026-4591	medium	5.1/10	kalcaddle kodbox fileThumb Endpoint app.php checkBin os command injection	Mar 23, 2026 5mo ago
CVE-2026-4590	low	2.3/10	kalcaddle kodbox loginSubmit API index.class.php cross-site request forgery	Mar 23, 2026 5mo ago
CVE-2026-33483	high	7.5/10	AVideo Affected by Unauthenticated Disk Space Exhaustion via Unlimited Temp File Creation in aVideoEncoderChunk.json.php	Mar 23, 2026 5mo ago
CVE-2026-33479	high	8.8/10	AVideo has PHP Code Injection via eval() in Gallery saveSort.json.php Exploitable Through CSRF Against Admin	Mar 23, 2026 5mo ago
CVE-2026-33354	high	7.6/10	AVideo has an authenticated arbitrary local file read via `chunkFile` path injection in `aVideoEncoder.json.php`	Mar 23, 2026 5mo ago
CVE-2026-33351	critical	9.1/10	AVideo has Unauthenticated SSRF via `webSiteRootURL` Parameter in saveDVR.json.php, Chaining to Verification Bypass	Mar 23, 2026 5mo ago
CVE-2026-33297	medium	5.1/10	AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php	Mar 23, 2026 5mo ago
CVE-2026-4589	medium	5.3/10	kalcaddle kodbox fileGet Endpoint editor.class.php PathDriverUrl server-side request forgery	Mar 23, 2026 5mo ago
CVE-2026-4588	medium	6.3/10	kalcaddle kodbox Site-level API key shareOut.class.php shareSafeGroup hard-coded key	Mar 23, 2026 5mo ago
CVE-2026-4587	medium	6.3/10	HybridAuth SSL Curl.php certificate validation	Mar 23, 2026 5mo ago
CVE-2026-4581	medium	6.9/10	code-projects Simple Laundry System Parameters checklogin.php sql injection	Mar 23, 2026 5mo ago
CVE-2026-4580	medium	6.9/10	code-projects Simple Laundry System Parameters checkupdatestatus.php sql injection	Mar 23, 2026 5mo ago
CVE-2026-4579	medium	6.9/10	code-projects Simple Laundry System Parameters viewdetail.php sql injection	Mar 23, 2026 5mo ago
CVE-2026-4578	medium	4.8/10	code-projects Exam Form Submission update_s3.php cross site scripting	Mar 23, 2026 5mo ago
CVE-2026-4577	medium	4.8/10	code-projects Exam Form Submission update_s4.php cross site scripting	Mar 23, 2026 5mo ago
CVE-2026-4576	medium	4.8/10	code-projects Exam Form Submission update_s5.php cross site scripting	Mar 23, 2026 5mo ago
CVE-2026-4575	medium	4.8/10	code-projects Exam Form Submission update_s2.php cross site scripting	Mar 23, 2026 5mo ago