Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.5GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs.Oct 15, 2026
- Medium6.5Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method.Oct 15, 2026
- High8.7Symfony is a PHP framework for web and console applications and a set of reusable PHP components.Oct 15, 2026
- Critical9.8WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerabilityOct 15, 2026
- High8.7WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint.EPSS 0.2%Oct 15, 2026
- Critical9.8WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameterEPSS 0.5%Oct 14, 2026
- Critical9.8WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.phpEPSS 0.5%Oct 14, 2026
- Medium5.3YOURLS is a self-hosted, customizable URL shortener written in PHP.EPSS 0.5%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter.EPSS 0.4%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter.EPSS 0.4%Oct 14, 2026
- Medium6.5svg-sanitizer is a PHP SVG/XML sanitizer.EPSS 0.4%Oct 14, 2026
- High7.2The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input .Oct 14, 2026
- High8.7Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators.Oct 12, 2026
- Medium5.1Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.phpEPSS 0.2%Oct 12, 2026
- High8.8Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution.Oct 12, 2026
- Medium5.4Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code.Oct 12, 2026
- Medium5.4Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions.Oct 12, 2026
- Medium5.3OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents.EPSS 0.3%Oct 11, 2026
- High8.2YOURLS is a self-hosted, customizable URL shortener written in PHP.EPSS 0.4%Aug 21, 2026
- Critical9.8Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.EPSS 0.4%Jul 30, 2026
- UnknownDrupal core - Critical - PHP object injection - SA-CORE-2026-005Jun 17, 2026
- Critical9.9Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.May 8, 2026
- Critical9.1Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property.May 8, 2026
- Medium5.7Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageContent functionMay 4, 2026
- Low2.1A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0.May 4, 2026
272 records · page 1 of 11
PreviousNext