Skip to content

Technology

PHP vulnerabilities

The PHP language runtime and the PHP package ecosystem (Packagist). 47,627 published CVES affecting PHP, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
47,627
Critical
6,126
High
15,725
Medium
23,973
Low
883
Unscored
920
CISA KEV
72
Atom feed of PHP alerts

Latest PHP CVEs

Newest publication first · page 15 of 40 · showing the latest 1,000

  3. CVE-2026-55186 Silverstripe MFA: Can bypass MFA during password reset flow

    Published
    MediumCVSS 4.2 EPSS 0.28% PoC

    Silverstripe MFA provides multi-factor authentication for Silverstripe CMS. Prior to 6.0.0, the CMS 5 password reset flow can issue a logged-in session after a user changes a password but before the user's configured multi-factor authentication challenge is completed. An attacker...

  8. CVE-2026-121263 phpMyAdmin MoTranslator Loader.php getTranslator path traversal

    Published
    MediumCVSS 5.3 EPSS 0.46%

    A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.1. The impacted element is the function Loader::getTranslator of the file motranslator-master/src/Loader.php. Executing a manipulation of the argument locale can lead to path traversal. The attack may be performe...

  10. CVE-2026-121262 phpMyAdmin SQL-Parser ExplainStatement.php parse type conversion

    Published
    MediumCVSS 6.9 EPSS 0.37%

    A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carri...

  11. CVE-2026-121261 phpMyAdmin ShapeFile SHP File loadFromFile infinite loop

    Published
    MediumCVSS 5.3 EPSS 0.29%

    A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public an...

  18. CVE-2026-121436 Froxlor 2.3.8 before 2.3.15 API Key Disclosure via api_keys.php

    Published
    HighCVSS 8.6 EPSS 0.45%

    Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey an...

  19. CVE-2026-119742 Nagios XI < 2026R2 OS Command Injection via mibs.php

    Published
    HighCVSS 8.6 EPSS 4.1%

    Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character-substitution filter that omits semicolons, pipes, and non-space IFS whitespace c...

  20. CVE-2026-120328 Information Disclosure in extension "Mail" (mail)

    Published
    MediumCVSS 6.9 EPSS 0.40%

    The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.

  22. CVE-2026-120329 Broken Access Control in extension "Mail" (mail)

    Published
    MediumCVSS 5.3 EPSS 0.31%

    Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.

  23. CVE-2026-120330 Broken Access Control in extension "Mail" (mail)

    Published
    HighCVSS 7.1 EPSS 0.36%

    Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mo...

  24. CVE-2026-120331 Server-Side Request Forgery in extension "Mail" (mail)

    Published
    MediumCVSS 5.3 EPSS 0.27%

    Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.

  25. CVE-2026-120332 Cross-Site Scripting in extension "Mail" (mail)

    Published
    MediumCVSS 5.1 EPSS 0.31%

    The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.