PHP vulnerabilities

Latest PHP CVEs

Newest publication first · page 5 of 40 · showing the latest 1,000

1. CVE-2026-128023 FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name Aliasing

   Published 2026-11-13

   Critical·CVSS 9.1 EPSS 0.51%

   FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that...

2. CVE-2026-128025 FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos

   Published 2026-11-13

   Medium·CVSS 6.9 EPSS 0.31%

   FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.txt/b.php to execute...

3. CVE-2026-128027 FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes

   Published 2026-11-13

   Critical·CVSS 9.3 EPSS 0.86%

   FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that Alpine, PHP, and Go applied under existing tags were not propagated. Remote attackers could exploit known flaws in the stale system libraries, such as CVE-2025-1...

4. CVE-2026-128046 OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options

   Published 2026-11-13

   Critical·CVSS 9.2 EPSS 0.71%

   OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a prod...

5. CVE-2026-128053 OpenMage magento-lts before 20.18.2 Reflected XSS via Error Pages SCRIPT_NAME

   Published 2026-11-13

   Low·CVSS 2.3 EPSS 0.30%

   OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that...

6. CVE-2026-128335 Contao before 5.3.54, 5.7.17, and 6.0.6 Session Invalidation Failure on 2FA Change

   Published 2026-11-13

   Low·CVSS 2.1 EPSS 0.35%

   Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already...

7. CVE-2026-126119 Streamit Plugin < 1.3.10 - Unauthenticated Remote Code Execution via Arbitrary Function Call

   Published 2026-11-13

   Critical·CVSS 9.8 EPSS 0.22%

   The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arb...

8. CVE-2026-125912 WP Ultimate CSV Importer < 9.2 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via Media Import

   Published 2026-11-13

   High·CVSS 7.2 EPSS 0.15%

   The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor validate the fetched content type, when importing remote media, allowing an Administrator of a Multisite subsite to write and execute arbitrary PHP in the shared...

9. CVE-2026-124833 Ahime Image Printer <= 1.0.0 - Unauthenticated Arbitrary File Upload

   Published 2026-11-13

   Critical·CVSS 9.8 EPSS 0.16%

   The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files before writing them to disk, allowing unauthenticated attackers to upload arbitrary files, including PHP, and execute code on the server.

10. CVE-2026-124822 Easy DragDrop File Uploader < 1.1.10 - Unauthenticated Arbitrary File Deletion via Path Traversal

    Published 2026-11-13

    Critical·CVSS 10.0 EPSS 0.15%

    The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting it, allowing unauthenticated users to delete arbitrary files and directories on the server, such as wp-config.php.

11. CVE-2026-118064 Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via featured_action

    Published 2026-11-13

    Critical·CVSS 9.8 EPSS 0.16%

    The Advance Guest Post WordPress plugin through 1.9 does not properly restrict or validate file uploads, authorizing an upload action with a nonce exposed to every front-end visitor and checking only a file's leading bytes, allowing unauthenticated users to upload arbitrary PHP f...

12. CVE-2026-118063 Advance Guest Post <= 1.9 - Unauthenticated Arbitrary File Upload via gallery_action

    Published 2026-11-13

    Critical·CVSS 9.8 EPSS 0.21%

    The Advance Guest Post WordPress plugin through 1.9 does not properly validate uploaded files, relying on a case-sensitive and incomplete extension check that unauthenticated users can trivially bypass, allowing them to upload arbitrary files, including executable PHP variants, i...

13. CVE-2026-127285 Cairo-dock Glx-Dock href Attribute bg_forum.php cross site scripting

    Published 2026-11-13

    Medium·CVSS 5.3 EPSS 0.26%

    A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg_forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has...

14. CVE-2026-127284 SourceCodester Food Ordering System Admin Write add_category.php sql injection

    Published 2026-11-13

    Medium·CVSS 6.9 EPSS 0.26%

    A security flaw has been discovered in SourceCodester Food Ordering System 1.0. This affects an unknown part of the file admin/add_category.php of the component Admin Write Handler. Performing a manipulation of the argument title/description/price/current_image/featured/active/id...

15. CVE-2026-127283 SourceCodester Food Ordering System Admin Image update_food.php unrestricted upload

    Published 2026-11-13

    Medium·CVSS 6.9 EPSS 0.29%

    A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted upload. The attack m...

16. CVE-2026-127282 SourceCodester Smart Attendance System with QR Code Scanner reset_password.php cross site scripting

    Published 2026-11-13

    Medium·CVSS 5.3 EPSS 0.27%

    A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality of the file reset_password.php. This manipulation of the argument Username causes cross site scripting. The attack is poss...

17. CVE-2026-121619 Symfony: The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies

    Published 2026-11-12

    Medium·CVSS 6.3 EPSS 0.19%

    The Symfony FrameworkBundle framework.trusted_proxies option and the HttpFoundation Request::setTrustedProxies() method trust remote clients as reverse proxies when the private_ranges shortcut is used, allowing remote attackers to spoof the client IP address, host and scheme in S...

18. CVE-2026-117551 Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8

    Published 2026-11-12

    Critical·CVSS 10.0 EPSS 0.44%

    Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution.

19. CVE-2026-127050 Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback

    Published 2026-11-12

    High·CVSS 7.1 EPSS 0.47%

    Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attacker...

20. CVE-2026-76173 SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.33%

    Blind SQL injection vulnerability in the public endpoint public/webhook/receiver.php of the WhatsApp module for Dolibarr 1.9. The phone number value derived from the data.key.remoteJid parameter, received via a JSON request, is incorporated into an SQL query without escaping or p...

21. CVE-2026-124814 Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

    Published 2026-11-12

    Critical·CVSS 9.8 EPSS 0.46%

    The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of uploaded files in its bundled file upload field, allowing unauthenticated users to upload arbitrary files such as PHP scripts and achieve remote code execution.

22. CVE-2026-117687 Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publish...

    Published 2026-11-12

    Medium·CVSS 6.9 EPSS 0.31%

    Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected produ...

23. CVE-2026-126813 Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid

    Published 2026-11-11

    High·CVSS 7.4 EPSS 1.1%

    Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to m...

24. CVE-2026-126810 WWBN AVideo 29.1.0 through 29.7.1 Stored XSS via Channel RSS Feed

    Published 2026-11-11

    Medium·CVSS 5.1 EPSS 0.24%

    WWBN AVideo 29.1.0 through 29.7.1 contains a stored cross-site scripting vulnerability that allows registered users to inject markup through the channel About field rendered in feed/index.php. Attackers can store an unquoted event-handler payload that bypasses feedHtmlDescription...

25. CVE-2026-126809 WWBN AVideo through 29.7.1 Missing Authorization via objects/import.json.php

    Published 2026-11-11

    Medium·CVSS 6.1 EPSS 0.37%

    WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in objects/import.json.php that allows uploaders to import other users' MP4 files by referencing any folder under videos/. Attackers can copy private, unlisted, password-protected or pay-per-view videos, re...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.