Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and before.Mar 27, 2026
- Medium6.5Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.Mar 27, 2026
- High7.7Daylight Studio FuelCMS v1.5.2 was discovered to contain a SQL injection vulnerability via the /controllers/Login.php component.Mar 26, 2026
- Critical9.8An issue in the /parser/dwoo component of Daylight Studio FuelCMS v1.5.2 allows attackers to execute arbitrary code via crafted PHP code.Mar 26, 2026
- High8.8KomSeo Cart 1.3 contains an SQL injection vulnerability that allows attackers to inject SQL commands through the 'my_item_search' parameter in edit.php.EPSS 0.2%Mar 26, 2026
- High8.1Saloon is a PHP library that gives users tools to build API integrations and SDKs.Mar 26, 2026
- High8.0Saloon is a PHP library that gives users tools to build API integrations and SDKs.Mar 26, 2026
- Medium6.6Saloon is a PHP library that gives users tools to build API integrations and SDKs.Mar 26, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Mr.EPSS 0.5%Mar 25, 2026
- Medium6.3league/commonmark is a PHP Markdown parser.Mar 24, 2026
- Medium6.9An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes.Mar 24, 2026
- Medium5.4JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting (XSS) vulnerability in the release function within app/home/c/UserController.php.Mar 24, 2026
- High8.8DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.Mar 24, 2026
- Medium5.4A Reflected Cross-Site Scripting (XSS) vulnerability exists in the POST request data zipPath of tiki-admin_system.php in Tiki version 21.2.EPSS 0.2%Mar 23, 2026
- Medium5.4A Cross-Site Scripting (XSS) vulnerability exists in the page parameter of tiki-editpage.php in Tiki version 26.3 and earlier.EPSS 0.2%Mar 23, 2026
- High7.1i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file parameter in index.php.EPSS 0.4%Mar 21, 2026
- High7.5SimpleJWT is a simple JSON web token library written in PHP.Mar 20, 2026
- High7.2An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.EPSS 0.9%Mar 20, 2026
- Medium5.1XinLiangCoder php_api_doc through commit 1ce5bbf contains a reflected cross-site scripting vulnerability in list_method.php that allows remote attackers to execute arb…Mar 20, 2026
- High8.2phpseclib is a PHP secure communications library.Mar 20, 2026
- High8.8Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.Mar 20, 2026
- Critical9.3FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.Mar 19, 2026
- High8.5FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.Mar 19, 2026
- High8.1FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.Mar 19, 2026
- High8.8Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the referer and user-agent.Mar 19, 2026