PHP vulnerabilities and fixes

CVEs that mention PHP, ranked by priority. 297 tracked.

PHP has 297 tracked vulnerabilities, 55 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 215. Most recent: 2026-10-24. Highest priority: CVE-2026-110447 (score 89/100).

• CVE-2026-110447 CRITICAL 9.2 EXPLOITED MITIGATE Collabora Online – Built-in CODE Server OS Command Injection Vulnerability
• CVE-2026-87902 HIGH 8.1 EXPLOITED UPGRADE WordPress Core Remote File Inclusion Vulnerability
• CVE-2026-109618 CRITICAL 9.8 UPGRADE MITIGATE PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the reques
• CVE-2026-109619 HIGH 8.1 UPGRADE MITIGATE PHP has various global state that temporarily points into request memory
• CVE-2023-25207 CRITICAL 9.8 UPGRADE PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
• CVE-2026-48030 CRITICAL 9.9 Pheditor is a single-file editor and file manager written in PHP
• CVE-2026-57517 CRITICAL 9.8 Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated r
• CVE-2023-2288 HIGH 8.8 UPGRADE The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing fi
• CVE-2026-64827 CRITICAL 9.8 Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authenti
• CVE-2026-70553 CRITICAL 9.8 MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arb
• CVE-2026-70554 CRITICAL 9.8 MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arb
• CVE-2026-72748 CRITICAL 9.1 AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpo
• CVE-2026-49827 CRITICAL 9.8 WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry
• CVE-2026-69703 CRITICAL 9.8 Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/cont
• CVE-2026-70552 CRITICAL 9.8 MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allo
• CVE-2023-2017 HIGH 8.8 UPGRADE Server-side Template Injection (SSTI) in Shopware 6 (<= v6.4.20.0, v6.5.0.0-rc1 <= v6.5.0.0-rc4), affecting bo
• CVE-2023-22974 HIGH 7.5 UPGRADE A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files b
• CVE-2026-17544 CRITICAL 9.8 UPGRADE Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PH
• CVE-2026-65883 CRITICAL 9.8 UPGRADE Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 2
• CVE-2026-67960 CRITICAL 9.8 An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserC
• CVE-2026-71207 CRITICAL 9.8 The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and buil
• CVE-2026-72592 CRITICAL 9.8 An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote att
• CVE-2026-76604 CRITICAL 10.0 Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2
• CVE-2026-71231 CRITICAL 9.8 IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE
• CVE-2026-115806 CRITICAL 9.8 The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versi
• CVE-2026-28139 CRITICAL 9.8 Unauthenticated PHP Object Injection in Ajax Search Lite <= 4.14.4 versions.
• CVE-2026-28149 CRITICAL 9.8 Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.
• CVE-2026-40725 CRITICAL 9.8 Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.
• CVE-2026-42380 CRITICAL 9.8 Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.
• CVE-2026-49108 CRITICAL 9.8 Unauthenticated PHP Object Injection in Moderno < 1.43 versions.
• CVE-2026-59544 CRITICAL 9.8 Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions.
• CVE-2026-65556 CRITICAL 9.8 Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
• CVE-2026-65571 CRITICAL 9.8 Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
• CVE-2026-65572 CRITICAL 9.8 Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
• CVE-2026-65574 CRITICAL 9.8 Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.
• CVE-2026-65575 CRITICAL 9.8 Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
• CVE-2026-65576 CRITICAL 9.8 Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.
• CVE-2026-65577 CRITICAL 9.8 Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
• CVE-2026-65579 CRITICAL 9.8 Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.
• CVE-2026-65581 CRITICAL 9.8 Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.
• CVE-2026-73341 CRITICAL 9.8 Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.
• CVE-2026-73366 CRITICAL 9.8 Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.
• CVE-2026-73376 CRITICAL 9.8 Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
• CVE-2026-73380 CRITICAL 9.8 Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.
• CVE-2026-63106 CRITICAL 9.8 ReadyEcommerce before 4.5.2 contains an unauthenticated SQL injection vulnerability in the product listing API
• CVE-2026-64796 CRITICAL 9.8 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not requ
• CVE-2026-43871 HIGH 7.5 UPGRADE Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java
• CVE-2026-32470 CRITICAL 9.8 Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.
• CVE-2026-49107 CRITICAL 9.8 Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.
• CVE-2026-65552 CRITICAL 9.8 Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
• CVE-2026-65573 CRITICAL 9.8 Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
• CVE-2026-65578 CRITICAL 9.8 Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
• CVE-2025-66844 CRITICAL 9.1 UPGRADE In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page c
• CVE-2026-35164 HIGH 8.8 UPGRADE Brave CMS is an open-source CMS
• CVE-2021-48016 CRITICAL 9.8 DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer hea
• CVE-2026-17543 CRITICAL 9.8 UPGRADE Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP
• CVE-2026-40521 HIGH 8.8 FrontAccounting before 2.4.20 contains a path traversal vulnerability in the attachment upload handler that al
• CVE-2026-48242 HIGH 8.1 Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, pass
• CVE-2026-67599 HIGH 7.2 ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticat
• CVE-2026-67608 HIGH 7.2 Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS comma
• CVE-2026-67285 CRITICAL 9.2 Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.
• CVE-2026-75827 HIGH 8.8 Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function
• CVE-2026-91765 HIGH 7.5 UPGRADE cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit
• CVE-2014-125134 HIGH 7.5 ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated a
• CVE-2026-59932 HIGH 7.5 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-59933 HIGH 7.5 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-72551 HIGH 8.8 A remote code execution vulnerability in Apioo Fusio 8.8.3 allows authenticated users with the Developer role
• CVE-2026-72556 HIGH 8.8 A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS comman
• CVE-2026-19342 HIGH 7.3 A vulnerability was detected in code-projects Task Management System 1.0
• CVE-2026-25784 CRITICAL 9.8 Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container i
• CVE-2025-58214 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2026-112850 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2026-49221 HIGH 8.8 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49228 HIGH 8.8 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-61523 HIGH 7.2 WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows aut
• CVE-2026-69118 HIGH 8.8 Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering th
• CVE-2014-125133 HIGH 7.5 NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthentica
• CVE-2025-58955 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2025-58958 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2025-58967 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2025-59550 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2025-59555 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2025-59558 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2025-59564 HIGH 8.1 UPGRADE Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2026-108358 HIGH 8.8 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-108359 HIGH 8.7 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-16767 MEDIUM 6.5 A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2
• CVE-2026-17545 HIGH 7.5 UPGRADE On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, C
• CVE-2026-18788 HIGH 7.3 A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0
• CVE-2026-19376 HIGH 7.3 A vulnerability has been found in Uasoft Badaso 3.0.0-alpha
• CVE-2026-41453 HIGH 8.8 Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authent
• CVE-2026-46382 HIGH 8.7 The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms
• CVE-2026-61524 HIGH 7.2 WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation
• CVE-2026-71252 HIGH 8.2 toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/tone
• CVE-2026-71488 HIGH 7.5 league/commonmark is a PHP library for parsing and rendering CommonMark Markdown
• CVE-2026-78202 HIGH 7.3 A vulnerability was found in itsourcecode Payroll System 1.0
• CVE-2016-20100 HIGH 7.5 Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allow
• CVE-2025-48090 HIGH 8.1 Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP
• CVE-2026-114403 HIGH 8.1 PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attacke
• CVE-2026-16765 HIGH 7.3 A vulnerability was determined in CodeAstro Online Classroom 1.0
• CVE-2026-19021 HIGH 7.3 A security vulnerability has been detected in SourceCodester Computer Repair Shop Management System 1.0
• CVE-2026-19196 HIGH 7.3 A vulnerability was found in SourceCodester Photo Share Website 1.0
• CVE-2026-19211 HIGH 7.3 A vulnerability was found in SourceCodester Photo Share Website 1.0
• CVE-2026-19231 HIGH 7.3 A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0
• CVE-2026-19343 HIGH 7.3 A flaw has been found in code-projects Task Management System 1.0
• CVE-2026-19344 HIGH 7.3 A vulnerability has been found in code-projects Task Management System 1.0
• CVE-2026-39445 HIGH 8.1 Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.
• CVE-2026-39446 HIGH 8.1 Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.
• CVE-2026-55676 HIGH 8.8 Malcolm is a network traffic analysis tool suite
• CVE-2026-66397 HIGH 8.6 phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category u
• CVE-2026-66398 CRITICAL 9.4 phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows aut
• CVE-2026-75014 HIGH 7.3 A flaw has been found in SourceCodester Pet Grooming Management Software 1.0
• CVE-2026-75079 HIGH 7.3 A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0
• CVE-2026-75080 HIGH 7.3 A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0
• CVE-2026-75089 HIGH 7.3 A weakness has been identified in PHPGurukul Complaint Management System 1.0
• CVE-2026-78201 HIGH 7.3 A vulnerability has been found in itsourcecode Payroll System 1.0
• CVE-2015-20124 HIGH 7.5 Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows
• CVE-2016-20101 HIGH 8.1 Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthen
• CVE-2018-25438 HIGH 7.5 Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress
• CVE-2025-62053 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2025-62055 HIGH 8.1 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulner
• CVE-2026-18958 HIGH 7.3 A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191
• CVE-2026-19345 MEDIUM 6.5 A vulnerability was found in code-projects Task Management System 1.0
• CVE-2026-32465 HIGH 8.8 Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.
• CVE-2026-49224 HIGH 8.3 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-49226 HIGH 8.3 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores
• CVE-2026-5665 HIGH 7.3 A security vulnerability has been detected in code-projects Online FIR System 1.0
• CVE-2026-5669 HIGH 7.3 A vulnerability has been found in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b49
• CVE-2026-57859 HIGH 7.5 e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler tha
• CVE-2026-60026 HIGH 8.9 Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla
• CVE-2026-67434 HIGH 7.3 PHP_CodeSniffer tokenizes PHP files and detects violations of a defined set of coding standards
• CVE-2026-69127 MEDIUM 6.9 Kirby is an open-source content management system
• CVE-2026-71291 HIGH 8.8 Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtensi
• CVE-2026-82814 HIGH 8.8 The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions
• CVE-2017-20287 HIGH 7.5 Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated
• CVE-2018-25439 HIGH 7.5 MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unaut
• CVE-2019-25778 HIGH 8.2 SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to man
• CVE-2019-25779 HIGH 7.5 WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to re
• CVE-2026-108357 HIGH 8.8 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-28176 HIGH 8.8 Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.
• CVE-2026-49332 HIGH 8.5 A flaw was found in openshift/oauth-proxy
• CVE-2026-59931 HIGH 7.7 PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files
• CVE-2026-72557 HIGH 8.8 An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of a
• CVE-2012-20002 HIGH 7.5 TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allow
• CVE-2015-20123 HIGH 7.5 Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauth
• CVE-2015-20125 HIGH 7.5 Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauth
• CVE-2017-20289 HIGH 7.5 Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability t
• CVE-2026-114254 HIGH 7.3 A vulnerability was identified in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591
• CVE-2026-114257 HIGH 7.3 A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb
• CVE-2026-114260 MEDIUM 6.5 A vulnerability has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591

FAQ

How do I fix PHP vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is PHP being exploited right now?

Yes: 2 PHP CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which PHP CVE should I patch first?

CVE-2026-110447 currently ranks highest (89/100): Collabora Online – Built-in CODE Server OS Command Injection Vulnerability.

← Back to latest CVEs