Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

336,845

All time

Critical · Active

10,645

CVSS ≥ 9.0

New · 14 days

1,495

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1381–1410 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-2133	medium	6.9/10	code-projects Online Music Site AdminUpdateCategory.php unrestricted upload	Feb 8, 2026 4mo ago
CVE-2026-2132	medium	6.9/10	code-projects Online Music Site AdminUpdateCategory.php sql injection	Feb 8, 2026 4mo ago
CVE-2026-2122	medium	5.3/10	Xiaopi Panel WAF Firewall demo.php sql injection	Feb 8, 2026 4mo ago
CVE-2026-2117	medium	6.9/10	itsourcecode Society Management System edit_activity.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-2116	medium	6.9/10	itsourcecode Society Management System edit_expenses.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-2115	medium	6.9/10	itsourcecode Society Management System delete_expenses.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-2114	medium	6.9/10	itsourcecode Society Management System edit_admin.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-2113	medium	6.9/10	yuan1994 tpadmin WebUploader preview.php deserialization	Feb 7, 2026 4mo ago
CVE-2026-2110	medium	6.3/10	Tasin1025 SwiftBuy login.php excessive authentication	Feb 7, 2026 4mo ago
CVE-2026-2090	medium	6.9/10	SourceCodester Online Class Record System search.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-2089	medium	6.9/10	SourceCodester Online Class Record System controller.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-2088	medium	6.9/10	PHPGurukul Beauty Parlour Management System accepted-appointment.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-2087	medium	6.9/10	SourceCodester Online Class Record System login.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-2083	medium	6.9/10	code-projects Social Networking Site delete_post.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-1634	medium	6.1/10	Subitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']	Feb 7, 2026 4mo ago
CVE-2026-2073	medium	6.9/10	itsourcecode School Management System index.php sql injection	Feb 7, 2026 4mo ago
CVE-2026-2064	medium	5.1/10	Portabilis i-Educar User Data meusdadod.php cross site scripting	Feb 6, 2026 4mo ago
CVE-2025-69214	high	8.7/10	OpenSTAManager has a SQL Injection in ajax_select.php (componenti endpoint)	Feb 6, 2026 4mo ago
CVE-2026-2060	medium	6.9/10	code-projects Simple Blood Donor Management System editcampaignform.php sql injection	Feb 6, 2026 4mo ago
CVE-2026-2059	medium	6.9/10	SourceCodester Medical Center Portal Management System emp_edit1.php sql injection	Feb 6, 2026 4mo ago
CVE-2026-2058	medium	6.9/10	mathurvishal CloudClassroom-PHP-Project Post Query Details postquerypublic.php sql injection	Feb 6, 2026 4mo ago
CVE-2026-2057	medium	6.9/10	SourceCodester Medical Center Portal Management System login.php sql injection	Feb 6, 2026 4mo ago
CVE-2026-2018	medium	6.9/10	itsourcecode School Management System controller.php sql injection	Feb 6, 2026 4mo ago
CVE-2026-2015	medium	5.3/10	Portabilis i-Educar Final Status Import FinalStatusImportService.php improper authorization	Feb 6, 2026 4mo ago
CVE-2026-2014	medium	6.9/10	itsourcecode Student Management System index.php sql injection	Feb 6, 2026 4mo ago
CVE-2026-2013	medium	6.9/10	itsourcecode Student Management System index.php sql injection	Feb 6, 2026 4mo ago
CVE-2026-2012	medium	6.9/10	itsourcecode Student Management System index.php sql injection	Feb 6, 2026 4mo ago
CVE-2026-2011	medium	6.9/10	itsourcecode Student Management System controller.php sql injection	Feb 6, 2026 4mo ago
CVE-2026-2009	medium	5.3/10	SourceCodester Gas Agency Management System createUser.php access control	Feb 6, 2026 4mo ago
CVE-2026-2000	medium	5.1/10	DCN DCME-320 Web Management Backend bridge_cfg.php apply_config command injection	Feb 6, 2026 4mo ago