Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-42723 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. | 13 Oct |
| CVE-2026-62050 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. | 13 Oct |
| CVE-2026-62051 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. | 13 Oct |
| CVE-2026-62052 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. | 13 Oct |
| CVE-2026-62053 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. | 13 Oct |
| CVE-2026-62054 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. | 13 Oct |
| CVE-2026-62076 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions. | 13 Oct |
| CVE-2026-62077 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions. | 13 Oct |
| CVE-2026-62086 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Juno <= 2.25 versions. | 13 Oct |
| CVE-2026-62087 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. | 13 Oct |
| CVE-2026-62090 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. | 13 Oct |
| CVE-2026-62120 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. | 13 Oct |
| CVE-2026-62123 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. | 13 Oct |
| CVE-2026-62124 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. | 13 Oct |
| CVE-2026-62125 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. | 13 Oct |
| CVE-2026-66482 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. | 13 Oct |
| CVE-2026-66483 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. | 13 Oct |
| CVE-2026-66563 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. | 13 Oct |
| CVE-2026-66564 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. | 13 Oct |
| CVE-2026-66565 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. | 13 Oct |
| CVE-2026-66567 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. | 13 Oct |
| CVE-2026-66568 | 9.8 critical | 0.00% | no CPE yet | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. | 13 Oct |
| CVE-2025-69930 | 9.8 critical | 0.00% | no CPE yet | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1. | 13 Oct |
| CVE-2025-69931 | 9.8 critical | 0.00% | no CPE yet | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1. | 13 Oct |
| CVE-2025-69933 | 9.8 critical | 0.00% | no CPE yet | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. | 13 Oct |
| CVE-2025-69934 | 9.8 critical | 0.00% | no CPE yet | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1. | 13 Oct |
| CVE-2025-69935 | 9.8 critical | 0.00% | no CPE yet | CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter. | 13 Oct |
| CVE-2025-69936 | 9.8 critical | 0.00% | no CPE yet | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. | 13 Oct |
| CVE-2025-69937 | 9.8 critical | 0.00% | no CPE yet | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id. | 13 Oct |
| CVE-2025-69938 | 9.8 critical | 0.00% | no CPE yet | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. | 13 Oct |
| CVE-2025-69946 | 9.8 critical | 0.00% | no CPE yet | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id. | 13 Oct |
| CVE-2025-69948 | 9.8 critical | 0.00% | no CPE yet | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. | 13 Oct |
| CVE-2025-65340 | 9.8 critical | 0.00% | no CPE yet | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /betweendates-detailsreports.php. | 13 Oct |
| CVE-2025-67403 | 9.8 critical | 0.00% | no CPE yet | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name. | 12 Oct |
| CVE-2025-67404 | 9.8 critical | 0.00% | no CPE yet | Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class. | 12 Oct |
| CVE-2025-69942 | 9.8 critical | 0.00% | no CPE yet | kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1. | 12 Oct |
| CVE-2025-69943 | 9.8 critical | 0.00% | no CPE yet | kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid. | 12 Oct |
| CVE-2025-69947 | 9.8 critical | 0.00% | no CPE yet | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1. | 12 Oct |
| CVE-2025-69941 | 9.8 critical | 0.00% | no CPE yet | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1. | 11 Oct |
| CVE-2026-103692 | 9.8 critical | 0.00% | no CPE yet | The Frontend Dashboard WordPress plugin before 3.0.5 does not perform any authorisation or nonce check on actions available to unauthenticated users that call an attacker-chosen PHP function or class method with the request data, allowing unauthenticated users to take over any account, including administrators. | 8 Oct |
| CVE-2026-44547 | 9.6 critical | 0.00% | no CPE yet | ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1. | Mon 26 Oct |
| CVE-2026-54458 | 9.6 critical | 0.00% | no CPE yet | WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the users_id_online array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast page_title into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including <img> with inline event handlers. Successful attackers can can read non-HttpOnly cookies and the CSRF token rendered into the admin dashboard, issue authenticated requests to any admin-only endpoint, exfiltrate the admin dashboard DOM, and chain into any admin-context mutation. When the victim is an AVideo administrator, the attacker turns a single anonymous WebSocket connection into full administrative takeover via the admin's own session. This issue has been patched by https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16. | 24 Oct |
| CVE-2026-54630 | 9.6 critical | 0.00% | no CPE yet | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache document root. The shipped Apache configuration routes .phar to PHP-FPM, so the stored file is executed as PHP on request. The per-attachment-type extension filter is empty by default and is not consulted by the upload handler in a way that blocks this, and a non-admin user in the default users group can create an attachment type with no filter and attach files to parts. Any authenticated user in the default users group uploads a .phar attachment to a part and fetches it under /media/, executing arbitrary PHP as the www-data web user. Ability to exploit depends on the webserver config, docker image contained the vulnerability by default. This issue has been patched in version 2.12.1. | 23 Oct |
| CVE-2025-4665 | 9.6 critical | 0.00% | no CPE yet | WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient validation of user input in plugin endpoints, allowing crafted input to influence backend queries in unexpected ways. Using specially crafted payloads, this can escalate into unsafe deserialization, enabling arbitrary object injection in PHP. Although the issue is remotely exploitable without authentication, it does require a crafted interaction with the affected endpoint in order to trigger successfully. | 8 Oct |
| CVE-2026-62668 | 9.4 critical | 0.00% | no CPE yet | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6. | 26 Oct |
| CVE-2026-66398 | 9.4 critical | 0.00% | no CPE yet | phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extract it into the application root to achieve code execution as the web server user. | 24 Oct |
| CVE-2025-61603 | 9.4 critical | 0.00% | wegia | WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/control.php endpoint, specifically in the descricao parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0. | 12 Oct |
| CVE-2025-61605 | 9.4 critical | 0.00% | wegia | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identified in the /pet/profile_pet.php endpoint, specifically in the id_pet parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0. | 12 Oct |
| CVE-2026-31845 | 9.3 critical | 0.00% | no CPE yet | A reflected cross-site scripting (XSS) vulnerability exists in Rukovoditel CRM version 3.6.4 and earlier in the Zadarma telephony API endpoint (/api/tel/zadarma.php). The application directly reflects user-supplied input from the 'zd_echo' GET parameter into the HTTP response without proper sanitization, output encoding, or content-type restrictions. | Mon 26 Oct |
| CVE-2026-33698 | 9.3 critical | 0.00% | chamilo, chamilo_lms | Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an unauthenticated attacker to modify existing files or create new files where allowed by system permissions. This only affects portals with the main/install/ directory still present and read-accessible. This vulnerability is fixed in 1.11.38. | Mon 26 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-11-01. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.