Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-36573 | feehi/feehicms | FeehiCMS Unrestricted Upload vulnerability | medium | 5.4 | 0% |
| CVE-2023-5953 | welcart-e-commerce (WordPress plugin) | The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF | high | 8.8 | 0% |
| CVE-2025-55743 | unopim/unopim | UnoPim vulnerable to remote code execution through Arbitrary File upload | high | 0.0 | 0% |
| CVE-2023-23937 | pimcore/pimcore | Pimcore contains Unrestricted Upload of File with Dangerous Type | medium | 5.4 | 0% |
| CVE-2026-38751 | devcode-it/openstamanager | OpenSTAManager contains an arbitrary file upload vulnerability in its module update functionality | high | 7.2 | 0% |
| CVE-2020-13241 | microweber/microweber | Microweber allows Unrestricted File Upload | high | 7.8 | 0% |
| CVE-2025-47658 | wsdesk (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpd | critical | 9.9 | 0% |
| CVE-2025-54677 | online-booking-\&-scheduling-calendar (WordPress plugin) | Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-s | critical | 9.1 | 0% |
| CVE-2023-6551 | verot/class.upload.php | class.upload.php allows cross-site scripting attacks via uploaded files | medium | 6.5 | 0% |
| CVE-2025-58048 | paymenter/paymenter | Paymenter vulnerable to Remote Code Execution via public file uploads | critical | 9.9 | 0% |
| CVE-2024-24753 | bref/bref | Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2 | medium | 4.8 | 0% |
| CVE-2025-13827 | mautic/grapes-js-builder-bundle | GrapesJsBuilder File Upload allows all file uploads | high | 0.0 | 0% |
| CVE-2026-104890 | kunstmaan/bundles-cms, kunstmaan/media-bundle | Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote c | high | 7.2 | 0% |
| CVE-2024-2125 | envialosimple-email-marketing-y-newsletters-gratis (WordPress plugin) | The EnvíaloSimple: Email Marketing y Newsletters plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and | high | 8.8 | 0% |
| CVE-2024-3112 | quotes-and-tips (WordPress plugin) | The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege use | medium | 4.8 | 0% |
| CVE-2026-71434 | statamic/cms | Statamic: Missing file upload validation on frontend forms allows uploading disallowed file types | medium | 5.3 | 0% |
| CVE-2024-47528 | librenms/librenms | LibreNMS vulnerable to Stored Cross-site Scripting via File Upload | medium | 4.8 | 0% |
| CVE-2026-54087 | easycorp/easyadmin-bundle | EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField | high | 7.6 | 0% |
| CVE-2026-33717 | wwbn/avideo | AVideo: Remote Code Execution via PHP Temp File in Encoder downloadURL | high | 8.8 | 0% |
| CVE-2024-51991 | october/october, october/system | October CMS Allows Unprotected SVG Rename in Media Manager | low | 0.0 | 0% |
| CVE-2025-51511 | cadmium-org/cadmium-cms | Cadmium CMS has a background arbitrary file upload vulnerability | high | 0.0 | 0% |
| CVE-2024-8725 | file-manager-advanced (WordPress plugin) | Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper chec | medium | 6.8 | 0% |
| CVE-2023-52892 | phpseclib/phpseclib | Name confusion in x509 Subject Alternative Name fields | high | 7.5 | 0% |
| CVE-2026-38991 | cockpit-hq/cockpit | Cockpit Vulnerable to Unrestricted Upload of File with Dangerous Type | high | 8.8 | 0% |
| CVE-2026-69246 | guzzlehttp/guzzle | Guzzle: Noncanonical host can bypass host-based checks | high | 7.2 | 0% |
| CVE-2024-9417 | hash-form (WordPress plugin) | The Hash Form – Drag & Drop Form Builder plugin for WordPress is vulnerable to limited file uploads due to a misconfigured file type validat | medium | 6.1 | 0% |
| CVE-2024-45960 | tribalsystems/zenario | Zenario allows authenticated admin users to upload PDF files containing malicious code | medium | 4.8 | 0% |
| CVE-2023-25365 | october/october | October CMS Cross-site Scripting vulnerability | high | 7.8 | 0% |
| CVE-2026-42551 | flightphp/core | Flight: HTTP method override enabled by default, facilitating CSRF escalation and middleware bypass | high | 7.5 | 0% |
| CVE-2025-58769 | auth0/auth0-php | auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import | low | 3.3 | 0% |
| CVE-2025-51489 | moonshine/moonshine | MoonShine Arbitrary File Upload Vulnerability | medium | 4.5 | 0% |
| CVE-2026-45066 | symfony/html-sanitizer, symfony/symfony | Symfony has an HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and <area> Misclassification | medium | 0.0 | 0% |
| CVE-2024-8918 | file-manager (WordPress plugin) | The File Manager Pro plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 8.3.9. This | high | 7.4 | 0% |
| CVE-2026-42844 | getgrav/grav | Low-privileged Grav API users can create super-admin accounts via blueprint-upload | high | 0.0 | 0% |
| CVE-2024-13544 | zarinpal-paid-download (WordPress plugin) | The Zarinpal Paid Download WordPress plugin through 2.3 does not properly validate uploaded files, allowing high privilege users such as adm | medium | 4.8 | 0% |
| CVE-2024-12042 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the pro | medium | 5.4 | 0% |
| CVE-2024-5226 | fuse-social-floating-sidebar (WordPress plugin) | The Fuse Social Floating Sidebar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the file upload functionality in all | medium | 6.4 | 0% |
| CVE-2024-3344 | otter-blocks (WordPress plugin) | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Stored Cross-Site Scripti | medium | 6.4 | 0% |
| CVE-2026-59882 | guzzlehttp/psr7 | guzzlehttp/psr7: Host Confusion via Weak URI Host Validation | medium | 4.2 | 0% |
| CVE-2024-10584 | directorypress (WordPress plugin) | The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG | medium | 5.4 | 0% |
| CVE-2024-13708 | woocommerce-jetpack (WordPress plugin) | The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2. | high | 7.2 | 0% |
| CVE-2025-8889 | compress-\&-upload (WordPress plugin) | The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin t | low | 3.8 | 0% |
| CVE-2025-27411 | redaxo/source | REDAXO allows Arbitrary File Upload in the mediapool page | medium | 5.4 | 0% |
| CVE-2026-54179 | backpack/crud | Laravel Backpack CRUD: SingleBase64Image accepts any base64 payload behind a `data:image` prefix — SVG-with-script lands on the public disk | medium | 4.4 | 0% |
| CVE-2024-1332 | custom-fonts (WordPress plugin) | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all vers | medium | 6.4 | 0% |
| CVE-2026-42879 | facturascripts/facturascripts | FacturaScripts Vulnerable to Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images | medium | 6.3 | 0% |
| CVE-2026-32278 | opensource-workshop/connect-cms | Connect CMS has Stored Cross-site Scripting (XSS) in the File Field of its Form Plugin | high | 8.2 | 0% |
| CVE-2025-47939 | typo3/cms-core | TYPO3 Allows Unrestricted File Upload in File Abstraction Layer | medium | 5.4 | 0% |
| GHSA-hgjx-r89m-m7v4 | facturascripts/facturascripts | FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE | critical | 9.9 | – |
| CVE-2026-76913 | notrinos/notrinos-erp | NotrinosERP: Authenticated arbitrary file upload leads to remote code execution via HRM employee "Documents" (doc_file) | high | 8.8 | – |