Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

335,499

All time

Critical · Active

10,538

CVSS ≥ 9.0

New · 14 days

704

Newly disclosed

Feed last synced

12 hrs ago

Data freshness

Showing 211–240 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2018-25404	high	8.8/10	The Open ISES Project 3.30A SQL Injection via add_facnote.php	May 29, 2026 29d ago
CVE-2018-25403	high	8.8/10	The Open ISES Project 3.30A SQL Injection via city_graph.php	May 29, 2026 29d ago
CVE-2018-25402	high	8.8/10	The Open ISES Project 3.30A SQL Injection via inc_types_graph.php	May 29, 2026 29d ago
CVE-2018-25401	high	8.8/10	The Open ISES Project 3.30A SQL Injection via sever_graph.php	May 29, 2026 29d ago
CVE-2018-25400	high	8.8/10	The Open ISES Project 3.30A SQL Injection via form_post.php	May 29, 2026 29d ago
CVE-2018-25399	high	8.8/10	The Open ISES Project 3.30A SQL Injection via nearby.php	May 29, 2026 29d ago
CVE-2018-25398	high	8.8/10	The Open ISES Project 3.30A SQL Injection via main.php	May 29, 2026 29d ago
CVE-2018-25397	medium	6.9/10	PHP-SHOP 1.0 Cross-Site Request Forgery via users.php	May 29, 2026 29d ago
CVE-2018-25395	high	8.8/10	Kados R10 GreenBee SQL Injection via update_feature.php	May 29, 2026 29d ago
CVE-2018-25394	high	8.8/10	Kados R10 GreenBee SQL Injection via update_release.php	May 29, 2026 29d ago
CVE-2018-25393	high	7.1/10	Navigate CMS 2.8.5 Path Traversal via navigate_download.php	May 29, 2026 29d ago
CVE-2018-25388	high	8.7/10	HaPe PKH 1.1 Arbitrary File Upload via aksi_foto.php	May 29, 2026 29d ago
CVE-2018-25387	medium	6.9/10	HaPe PKH 1.1 Cross-Site Request Forgery via aksi_user.php	May 29, 2026 29d ago
CVE-2018-25386	high	8.8/10	HaPe PKH 1.1 SQL Injection via id Parameter in admin/media.php	May 29, 2026 29d ago
CVE-2026-45580	medium	5.4/10	WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute	May 29, 2026 29d ago
CVE-2026-45578	high	8.8/10	WWBN AVideo Live: OS command injection in on_publish.php execAsync via unescaped m3u8 URL	May 29, 2026 29d ago
CVE-2026-45610	medium	5.7/10	WWBN AVideo plugin/LoginControl/set.json.php: 2FA toggle endpoint has no CSRF protection, letting an attacker page silently disable a logged-in victim's 2FA	May 29, 2026 29d ago
CVE-2026-45620	medium	5.3/10	AVideo CVE-2026-43881 incomplete fix - `objects/mention.json.php:17` is an unauthenticated user enumeration	May 29, 2026 29d ago
CVE-2026-45731	medium	6.9/10	WWBN AVideo: Authenticated Arbitrary File Read in view/update.php	May 29, 2026 29d ago
CVE-2026-46337	medium	6.9/10	WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`	May 29, 2026 29d ago
CVE-2025-11993	high	8.8/10	WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection	May 29, 2026 29d ago
CVE-2026-24444	critical	9.3/10	SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php	May 28, 2026 1mo ago
CVE-2026-35676	high	8.2/10	phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint	May 28, 2026 1mo ago
CVE-2026-35675	high	8.2/10	phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update	May 28, 2026 1mo ago
CVE-2026-35672	high	7.5/10	phpMyFAQ - Authentication Bypass via Empty API Token	May 28, 2026 1mo ago
CVE-2026-35671	high	8.8/10	phpMyFAQ - Insecure Direct Object Reference in User Password API	May 28, 2026 1mo ago
CVE-2026-2374	high	7.2/10	Login No Captcha reCAPTCHA <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via PHP_SELF	May 28, 2026 1mo ago
CVE-2026-42878	medium	5.3/10	FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts	May 27, 2026 1mo ago
CVE-2026-45027	medium	5.9/10	WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php	May 27, 2026 1mo ago
CVE-2026-8707	medium	6.1/10	NS Product icon badge <= 1.2.4 - Reflected Cross-Site Scripting via PHP_SELF	May 27, 2026 1mo ago