Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,295

All time

Critical · Active

12,000

CVSS ≥ 9.0

New · 14 days

2,715

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1231–1260 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-4573	medium	5.3/10	SourceCodester Simple E-learning System HTTP GET Parameter delete_post.php sql injection	Mar 23, 2026 5mo ago
CVE-2026-4572	medium	5.3/10	SourceCodester Sales and Inventory System HTTP POST Request view_product.php sql injection	Mar 23, 2026 5mo ago
CVE-2026-4571	medium	5.3/10	SourceCodester Sales and Inventory System HTTP POST Request view_payments.php sql injection	Mar 23, 2026 5mo ago
CVE-2026-4570	medium	5.3/10	SourceCodester Sales and Inventory System HTTP POST Request view_customers.php sql injection	Mar 23, 2026 5mo ago
CVE-2026-4569	medium	5.3/10	SourceCodester Sales and Inventory System HTTP POST Request view_category.php sql injection	Mar 23, 2026 5mo ago
CVE-2026-4568	medium	5.3/10	SourceCodester Sales and Inventory System HTTP GET Request update_supplier.php sql injection	Mar 23, 2026 5mo ago
CVE-2026-4563	medium	5.3/10	MacCMS Member Order Detail User.php order_info authorization	Mar 22, 2026 5mo ago
CVE-2026-4562	medium	6.9/10	MacCMS Timming API Endpoint Timming.php weak authentication	Mar 22, 2026 5mo ago
CVE-2026-4557	medium	5.3/10	code-projects Exam Form Submission update_s1.php cross site scripting	Mar 22, 2026 5mo ago
CVE-2026-33296	low	2.1/10	AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php	Mar 22, 2026 5mo ago
CVE-2026-33295	high	8.2/10	AVideo Vulnerable to Stored XSS via Unescaped Video Title in CDN downloadButtons.php	Mar 22, 2026 5mo ago
CVE-2026-4550	medium	5.1/10	code-projects Simple Gym Management System func.php sql injection	Mar 22, 2026 5mo ago
CVE-2019-25592	medium	6.9/10	PHPRunner 10.1 Denial of Service via Dashboard Name Field	Mar 22, 2026 5mo ago
CVE-2026-4540	medium	6.9/10	projectworlds Online Notes Sharing System Parameters login.php sql injection	Mar 22, 2026 5mo ago
CVE-2026-4533	medium	5.3/10	code-projects Simple Food Ordering System all-tickets.php sql injection	Mar 22, 2026 5mo ago
CVE-2019-25580	high	8.8/10	ownDMS 4.7 SQL Injection via pdfstream.php imagestream.php	Mar 21, 2026 5mo ago
CVE-2019-25579	high	8.7/10	phpTransformer 2016.9 Directory Traversal via jQueryFileUpload	Mar 21, 2026 5mo ago
CVE-2019-25578	high	8.8/10	phpTransformer 2016.9 SQL Injection via GeneratePDF.php	Mar 21, 2026 5mo ago
CVE-2026-4514	medium	5.3/10	PbootCMS Backend UserController.php access control	Mar 21, 2026 5mo ago
CVE-2026-4510	medium	5.3/10	PbootCMS Parameter MemberController.php alert_location cross site scripting	Mar 21, 2026 5mo ago
CVE-2026-4509	medium	5.3/10	PbootCMS File Upload file.php incomplete blacklist	Mar 21, 2026 5mo ago
CVE-2026-1647	medium	6.1/10	Comment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']	Mar 21, 2026 5mo ago
CVE-2026-33238	medium	4.3/10	AVideo has a Path Traversal in listFiles.json.php that Enables Server Filesystem Enumeration	Mar 20, 2026 5mo ago
CVE-2026-4508	medium	6.9/10	PbootCMS Member Login MemberController.php checkUsername sql injection	Mar 20, 2026 5mo ago
CVE-2026-32844	medium	5.1/10	XinLiangCoder / php_api_doc Reflected XSS via list_method.php	Mar 20, 2026 5mo ago
CVE-2026-4485	medium	5.3/10	itsourcecode College Management System search_student.php sql injection	Mar 20, 2026 5mo ago
CVE-2026-33136	critical	9.3/10	WeGIA has Reflected Cross-Site Scripting (XSS) in `listar_memorandos_ativos.php` via `sccd` parameter	Mar 20, 2026 5mo ago
CVE-2026-33135	critical	9.3/10	WeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter	Mar 20, 2026 5mo ago
CVE-2026-33134	critical	9.3/10	WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter	Mar 20, 2026 5mo ago
CVE-2026-0677	—	—	WordPress TotalContest Lite plugin <= 2.9.1 - PHP Object Injection vulnerability	Mar 20, 2026 5mo ago