Feed live

php CVEs

Name: AskarLabs CMS CVE Database
License: https://creativecommons.org/licenses/by/4.0/
Keywords: CVE, vulnerability, CMS, WordPress, Joomla, Drupal, plugin, theme, security

Every published CVE that touches a CMS, plugin, theme, or page builder — indexed, scored, and cross-referenced against the components running on your sites.

Total CVEs tracked

347,158

All time

Critical · Active

11,973

CVSS ≥ 9.0

New · 14 days

2,676

Newly disclosed

Feed last synced

1 hr ago

Data freshness

Showing 241–270 CVEs

Sorted by Published · Newest first

CVE ID	Severity	CVSS	Title	Published
CVE-2026-14639	medium	5.3/10	CodeAstro Ecommerce Website my_account.php sql injection	Jul 4, 2026 1mo ago
CVE-2026-14638	medium	5.3/10	itsourcecode Hospital Management System patient.php sql injection	Jul 4, 2026 1mo ago
CVE-2026-14637	high	8.8/10	kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization	Jul 4, 2026 1mo ago
CVE-2026-14636	medium	5.3/10	kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_others_images path traversal	Jul 4, 2026 1mo ago
CVE-2026-14634	medium	5.3/10	kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scripting	Jul 4, 2026 1mo ago
CVE-2026-14632	medium	5.3/10	kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect	Jul 4, 2026 1mo ago
CVE-2026-12194	low	2.3/10	PHPIPAM Authenticated LFI	Jul 4, 2026 1mo ago
CVE-2026-14619	medium	5.3/10	itsourcecode Hospital Management System medicine.php sql injection	Jul 4, 2026 1mo ago
CVE-2026-14608	medium	5.3/10	SourceCodester CET Automated Grading System with AI Predictive Analytics POST index.php view_student authorization	Jul 3, 2026 1mo ago
CVE-2026-58455	critical	9.2/10	Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php	Jul 2, 2026 1mo ago
CVE-2026-56037	high	8.8/10	WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability	Jul 2, 2026 1mo ago
CVE-2026-57677	critical	9.8/10	WordPress Novalnet Payment Gateway for WooCommerce plugin <= 12.10.3 - PHP Object Injection vulnerability	Jul 2, 2026 1mo ago
CVE-2026-57621	critical	9.8/10	WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability	Jul 2, 2026 1mo ago
CVE-2026-27414	high	8.8/10	WordPress Werkstatt theme <= 4.8.3 - PHP Object Injection vulnerability	Jul 2, 2026 1mo ago
CVE-2026-27060	high	8.8/10	WordPress ARMember Premium plugin <= 7.0 - PHP Object Injection vulnerability	Jul 2, 2026 1mo ago
CVE-2026-58451	high	7.1/10	Horde IMP < 7.0.1 Path Traversal via Compose.php img src	Jul 1, 2026 1mo ago
CVE-2026-34112	critical	9.3/10	Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php	Jul 1, 2026 1mo ago
CVE-2026-34103	critical	9.3/10	Guardian Language-System Unauthenticated SQL Injection via id Parameter in subtitles.php	Jul 1, 2026 1mo ago
CVE-2026-34097	medium	4.8/10	Guardian Language-System XSS via id Parameter in text_file.php	Jul 1, 2026 1mo ago
CVE-2026-13706	—	0.0/10	UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG	Jul 1, 2026 1mo ago
CVE-2026-57995	high	8.7/10	phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions	Jun 30, 2026 1mo ago
CVE-2026-12240	high	8.0/10	Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field	Jun 30, 2026 1mo ago
CVE-2026-13579	medium	5.3/10	itsourcecode Hospital Management System patientchangepassword.php sql injection	Jun 29, 2026 1mo ago
CVE-2026-13578	medium	5.3/10	itsourcecode Hospital Management System patientdetail.php sql injection	Jun 29, 2026 1mo ago
CVE-2026-56124	high	8.7/10	phpUploader < 2.0.2 Unauthenticated Database Exposure via index model	Jun 29, 2026 1mo ago
CVE-2026-13572	medium	5.3/10	itsourcecode Hospital Management System insertbillingrecord.php sql injection	Jun 29, 2026 1mo ago
CVE-2026-13571	medium	6.9/10	SourceCodester Simple Food Ordering System cart.php logic error	Jun 29, 2026 1mo ago
CVE-2026-13570	medium	5.1/10	SourceCodester Inventory Management System User Registration Endpoint users_handler.php cross site scripting	Jun 29, 2026 1mo ago
CVE-2026-13569	medium	5.1/10	weng-xianhu EyouCMS API index.php sql injection	Jun 29, 2026 1mo ago
CVE-2026-13568	medium	6.9/10	SourceCodester Inventory Management System User Registration Endpoint users_handler.php access control	Jun 29, 2026 1mo ago