Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,298

All time

Critical · Active

12,002

CVSS ≥ 9.0

New · 14 days

2,702

Newly disclosed

Feed last synced

58 mins ago

Data freshness

Showing 1261–1290 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-4474	medium	4.8/10	itsourcecode University Management System admin_single_student_update.php cross site scripting	Mar 20, 2026 5mo ago
CVE-2026-33041	medium	5.3/10	AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php	Mar 20, 2026 5mo ago
CVE-2026-4473	medium	5.1/10	itsourcecode Online Doctor Appointment System appointment_action.php sql injection	Mar 20, 2026 5mo ago
CVE-2026-4472	medium	5.3/10	itsourcecode Online Frozen Foods Ordering System admin_edit_supplier.php sql injection	Mar 20, 2026 5mo ago
CVE-2026-4471	medium	5.1/10	itsourcecode Online Frozen Foods Ordering System admin_edit_employee.php sql injection	Mar 20, 2026 5mo ago
CVE-2026-4470	medium	5.1/10	itsourcecode Online Frozen Foods Ordering System admin_edit_menu.php sql injection	Mar 20, 2026 5mo ago
CVE-2026-4469	medium	5.1/10	itsourcecode Online Frozen Foods Ordering System admin_edit_menu_action.php sql injection	Mar 20, 2026 5mo ago
CVE-2026-32935	high	8.2/10	phpseclib's AES-CBC unpadding susceptible to padding oracle timing attack	Mar 20, 2026 5mo ago
CVE-2026-32880	medium	6.4/10	ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.php	Mar 20, 2026 5mo ago
CVE-2026-33346	high	8.7/10	OpenEMR has stored XSS in portal_payment.php via Unescaped table_args	Mar 19, 2026 5mo ago
CVE-2026-32843	medium	5.1/10	Linkit ONE Location Aware Sensor System (LASS) Reflected XSS via PM25.php	Mar 19, 2026 5mo ago
CVE-2026-25445	high	8.8/10	WordPress WishList Member X plugin <= 3.29.0 - PHP Object Injection vulnerability	Mar 19, 2026 5mo ago
CVE-2025-60237	critical	9.8/10	WordPress Finag theme <= 1.5.0 - PHP Object Injection vulnerability	Mar 19, 2026 5mo ago
CVE-2025-60233	critical	9.8/10	WordPress Zuut theme <= 1.4.2 - PHP Object Injection vulnerability	Mar 19, 2026 5mo ago
CVE-2026-32321	high	8.8/10	ClipBucket v5 has time-based Blind SQL Injection in ajax.php that leads to Data Exfiltration	Mar 18, 2026 5mo ago
CVE-2026-25449	critical	9.8/10	WordPress Traveler theme < 3.2.8.1 - PHP Object Injection vulnerability	Mar 18, 2026 5mo ago
CVE-2026-4356	medium	4.8/10	itsourcecode University Management System add_result.php cross site scripting	Mar 18, 2026 5mo ago
CVE-2026-4355	medium	5.1/10	Portabilis i-Educar Endpoint educar_servidor_curso_lst.php cross site scripting	Mar 17, 2026 5mo ago
CVE-2026-4319	medium	6.9/10	code-projects Simple Food Order System add-item.php sql injection	Mar 17, 2026 5mo ago
CVE-2026-28430	critical	9.3/10	Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php	Mar 16, 2026 5mo ago
CVE-2026-4241	medium	5.3/10	itsourcecode College Management System time-table.php sql injection	Mar 16, 2026 5mo ago
CVE-2026-4238	medium	5.1/10	itsourcecode College Management System courses.php sql injection	Mar 16, 2026 5mo ago
CVE-2026-4237	medium	6.9/10	itsourcecode Free Hotel Reservation System index.php sql injection	Mar 16, 2026 5mo ago
CVE-2026-4236	medium	6.9/10	itsourcecode Online Enrollment System index.php sql injection	Mar 16, 2026 5mo ago
CVE-2026-4235	medium	6.9/10	itsourcecode Online Enrollment System login.php sql injection	Mar 16, 2026 5mo ago
CVE-2026-4225	medium	4.8/10	CMS Made Simple User Management listusers.php cross site scripting	Mar 16, 2026 5mo ago
CVE-2026-4223	medium	6.9/10	itsourcecode Payroll Management System manage_employee.php sql injection	Mar 16, 2026 5mo ago
CVE-2026-4189	medium	5.1/10	phpipam Section edit-result.php sql injection	Mar 15, 2026 5mo ago
CVE-2026-4186	medium	5.1/10	UEditor JSONP Callback controller.php cross site scripting	Mar 15, 2026 5mo ago
CVE-2015-20119	medium	5.1/10	RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.php	Mar 15, 2026 5mo ago