Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2021-45394 | spipu/html2pdf | Cross-site Scripting in HTML2PDF | high | 8.8 | 2% |
| CVE-2017-16790 | symfony/form, symfony/symfony | Symfony SSRF Vulnerability via Form Component | medium | 6.5 | 2% |
| CVE-2020-11066 | typo3/cms, typo3/cms-core | Class destructors causing side-effects when being unserialized in TYPO3 CMS | high | 8.7 | 2% |
| CVE-2021-22970 | concrete5/core | Server-Side Request Forgery in Concrete CMS | medium | 0.0 | 1% |
| CVE-2020-24063 | canto (WordPress plugin) | The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF. | high | 7.2 | 1% |
| CVE-2022-45152 | moodle/moodle | Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library | critical | 9.1 | 1% |
| CVE-2019-7911 | magento/community-edition, magento/magento1ce, magento/magento1ee +1 more | Magento 2 Community Edition Server-Side Request Forgery vulnerability | high | 7.2 | 1% |
| CVE-2019-7913 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SSRF vulnerability | high | 7.2 | 1% |
| CVE-2019-7923 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition SSRF vulnerability | high | 7.2 | 1% |
| CVE-2021-36396 | moodle/moodle | Moodle vulnerable to Server-Side Request Forgery | high | 7.5 | 1% |
| CVE-2019-6970 | moodle/moodle | Moodle SSRF Vulnerability | high | 7.5 | 1% |
| CVE-2022-1239 | hubspot (WordPress plugin) | The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with th | high | 8.8 | 1% |
| CVE-2021-39339 | telefication (WordPress plugin) | The Telefication WordPress plugin is vulnerable to Open Proxy and Server-Side Request Forgery via the ~/bypass.php file due to a user-suppli | medium | 5.8 | 1% |
| CVE-2022-2352 | post-smtp (WordPress plugin) | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high | high | 7.2 | 1% |
| CVE-2017-1000017 | phpmyadmin/phpmyadmin | phpMyAdmin SSRF in replication | high | 8.8 | 1% |
| CVE-2022-1037 | exmage (WordPress plugin) | The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF iss | high | 7.2 | 1% |
| CVE-2017-1000419 | phpbb/phpbb | phpBB Server-Side Request Forgery (SSRF) | high | 7.5 | 1% |
| CVE-2020-13970 | shopware/platform | Shopware vulnerable to SSRF | high | 8.8 | 1% |
| CVE-2019-8158 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition XML Injection | critical | 9.8 | 1% |
| CVE-2024-34111 | magento/community-edition | Magento Open Source Server-Side Request Forgery (SSRF) vulnerability | medium | 6.5 | 1% |
| CVE-2021-22958 | concrete5/concrete5 | Server-Side Request Forgery vulnerability in concrete5 | high | 8.2 | 1% |
| CVE-2022-24980 | kitodo/presentation | SSRF in Kitodo.Presentation | high | 7.5 | 1% |
| CVE-2013-6919 | james-heinrich/phpthumb | phpThumb is vulnerable to Server-Side Request Forgery (SSRF) | medium | 0.0 | 1% |
| CVE-2012-10018 | mapplic (WordPress plugin) | The Mapplic and Mapplic Lite plugins for WordPress are vulnerable to Server-Side Request Forgery in versions up to, and including 6.1, 1.0 r | high | 8.3 | 1% |
| CVE-2019-11767 | phpbb/phpbb | phpBB Server side request forgery (SSRF) | medium | 5.8 | 1% |
| CVE-2021-30108 | feehi/cms | Server-Side Request Forgery in Feehi CMS | critical | 9.1 | 1% |
| CVE-2019-6257 | studio-42/elfinder | elFinder Server Side Request Forgery (SSRF) | high | 7.7 | 1% |
| CVE-2023-29291 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 4.9 | 1% |
| CVE-2022-3708 | web-stories (WordPress plugin) | The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficien | critical | 9.6 | 1% |
| CVE-2022-35651 | moodle/moodle | Moodle Stored XSS and blind SSRF possible via SCORM track details | medium | 6.1 | 1% |
| CVE-2023-38207 | magento/community-edition, magento/project-community-edition | Magento Open Source allows XML Injection | medium | 5.3 | 1% |
| CVE-2022-24871 | shopware/core, shopware/platform | Server-Side Request Forgery (SSRF) in Shopware | high | 7.2 | 1% |
| CVE-2021-37711 | shopware/core, shopware/platform | Authenticated server-side request forgery in file upload via URL. | high | 8.8 | 1% |
| CVE-2021-27312 | gleez/cms | Gleez Cms Server Side Request Forgery (SSRF) vulnerability | critical | 9.0 | 1% |
| CVE-2021-24371 | rsvpmaker (WordPress plugin) | The Import feature of the RSVPMaker WordPress plugin before 8.7.3 (/wp-admin/tools.php?page=rsvpmaker_export_screen) takes an URL input and | low | 2.7 | 1% |
| CVE-2022-40700 | admin-css-mu (WordPress plugin), amo-for-wp---membership-management (WordPress plugin), amp-toolbox (WordPress plugin) +12 more | Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership | high | 8.2 | 1% |
| CVE-2022-0085 | dompdf/dompdf | Server-Side Request Forgery in dompdf/dompdf | medium | 5.3 | 1% |
| CVE-2022-36376 | rankmath/seo-by-rank-math, seo (WordPress plugin) | Rank Math SEO plugin vulnerable to Server-Side Request Forgery | critical | 9.8 | 1% |
| CVE-2024-55638 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2020-8226 | phpbb/phpbb | phpBB Server-Side Request Forgery Vulnerability | medium | 5.8 | 1% |
| CVE-2017-16870 | updraftplus (WordPress plugin) | The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraft_ajax_handler function in /wp-content/plugins/updraftplus/admin. | high | 8.1 | 1% |
| CVE-2023-29292 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Server-Side Request Forgery (SSRF) | medium | 4.9 | 1% |
| CVE-2020-24141 | wp-downloadmanager (WordPress plugin) | Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end s | medium | 5.3 | 1% |
| CVE-2024-55636 | drupal/core, drupal/core-recommended, drupal/drupal | Drupal core contains a potential PHP Object Injection vulnerability that (if combined with another exploit) could lead t | critical | 9.8 | 1% |
| CVE-2023-22247 | magento/community-edition, magento/project-community-edition | Magento Open Source allows XML Injection | high | 7.5 | 1% |
| CVE-2021-4075 | snipe/snipe-it | Server-Side Request Forgery in snipe/snipe-it | high | 7.2 | 1% |
| CVE-2022-24739 | rudloff/alltube | Server-Side Request Forgery and Open Redirect in AllTube Download | high | 7.3 | 1% |
| CVE-2022-3247 | blog2social (WordPress plugin) | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does n | medium | 6.5 | 1% |
| CVE-2024-45119 | magento/community-edition | Magento Open Source Server-Side Request Forgery (SSRF) vulnerability | medium | 4.9 | 1% |
| CVE-2023-29289 | magento/community-edition, magento/project-community-edition | Magento Open Source allows XML Injection | medium | 6.5 | 1% |