Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,368

All time

Critical · Active

12,003

CVSS ≥ 9.0

New · 14 days

2,212

Newly disclosed

Feed last synced

2 hrs ago

Data freshness

Showing 1711–1740 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-1444	medium	4.8/10	iJason-Liu Books_Manager add_book_check.php cross site scripting	Jan 26, 2026 7mo ago
CVE-2026-1443	medium	6.9/10	code-projects Online Music Site AdminDeleteUser.php sql injection	Jan 26, 2026 7mo ago
CVE-2026-1424	medium	5.1/10	PHPGurukul News Portal Profile Pic unrestricted upload	Jan 26, 2026 7mo ago
CVE-2026-1423	medium	5.3/10	code-projects Online Examination System admin_pic.php unrestricted upload	Jan 26, 2026 7mo ago
CVE-2026-1422	medium	6.9/10	code-projects Online Examination System Login Page index.php sql injection	Jan 26, 2026 7mo ago
CVE-2025-6461	medium	4.3/10	CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Post Disclosure in class-cubewp-search-ajax-hooks.php	Jan 25, 2026 7mo ago
CVE-2025-13676	medium	6.1/10	JustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF	Jan 24, 2026 7mo ago
CVE-2026-24422	medium	5.3/10	phpMyFAQ: Public API endpoints expose emails and invisible questions	Jan 24, 2026 7mo ago
CVE-2026-24420	medium	6.5/10	phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)	Jan 24, 2026 7mo ago
CVE-2026-24421	medium	6.5/10	phpMyFAQ missing authorization exposes /api/setup/backup to any authenticated user	Jan 24, 2026 7mo ago
CVE-2026-24138	high	7.5/10	FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`	Jan 23, 2026 7mo ago
CVE-2025-69099	high	8.8/10	WordPress North theme <= 5.7.5 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-69036	high	8.8/10	WordPress Tech Life CPT plugin <= 16.4 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-69035	high	8.8/10	WordPress Dental Care CPT plugin <= 20.2 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-69002	high	8.8/10	WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68903	high	8.8/10	WordPress Anona theme <= 8.0 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68899	high	8.8/10	WordPress Vivagh theme <= 2.4 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-68047	high	8.8/10	WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-67619	high	8.8/10	WordPress Kids Heaven theme <= 3.2 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-67617	critical	9.8/10	WordPress Consult Aid theme <= 1.4.3 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2025-50004	high	8.8/10	WordPress JupiterX Core plugin <= 4.10.1 - PHP Object Injection vulnerability	Jan 22, 2026 7mo ago
CVE-2021-47778	high	8.6/10	GetSimple CMS My SMTP Contact Plugin 1.1.2 - PHP Code Injection	Jan 21, 2026 7mo ago
CVE-2026-0726	high	8.1/10	Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'	Jan 20, 2026 7mo ago
CVE-2026-1203	medium	6.3/10	CRMEB JSON Token LoginServices.php remoteRegister improper authentication	Jan 20, 2026 7mo ago
CVE-2026-1202	medium	6.9/10	CRMEB LoginController.php appleLogin improper authentication	Jan 20, 2026 7mo ago
CVE-2026-1192	medium	6.9/10	Tosei Online Store Management System ネット店舗管理システム imode_alldata.php command injection	Jan 19, 2026 7mo ago
CVE-2026-1176	medium	6.9/10	itsourcecode School Management System index.php sql injection	Jan 19, 2026 7mo ago
CVE-2026-1160	medium	6.9/10	PHPGurukul Directory Management System Search index.php sql injection	Jan 19, 2026 7mo ago
CVE-2026-1159	medium	6.9/10	itsourcecode Online Frozen Foods Ordering System order_online.php sql injection	Jan 19, 2026 7mo ago
CVE-2026-1154	medium	5.3/10	SourceCodester E-Learning System Lesson index.php cross site scripting	Jan 19, 2026 7mo ago