Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2010-3313 | egroupware/egroupware | EGroupware Code Injection vulnerability | high | 0.0 | 9% |
| CVE-2009-3890 | WordPress core | Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress before 2.8.6, when a cert | medium | 6.0 | 8% |
| CVE-2020-9664 | magento/core | Magento php object injection vulnerability | critical | 9.8 | 8% |
| CVE-2022-23614 | twig/twig | Code injection in Twig | high | 8.8 | 8% |
| CVE-2014-8949 | imember360 (WordPress plugin) | The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via she | medium | 6.0 | 8% |
| CVE-2021-36394 | moodle/moodle | Moodle Session Fixation vulnerability | critical | 9.8 | 7% |
| CVE-2014-8770 | dweeves/magmi | MAGMI plugin for Magento Unsafe File Upload | high | 0.0 | 7% |
| CVE-2014-2921 | pimcore/pimcore | Pimcore Vulnerable to PHP Object Injection Attacks | high | 0.0 | 6% |
| CVE-2015-5243 | brightlocal/phpwhois, david-garcia/phpwhois, ivankristianto/phpwhois +7 more | phpWhois arbitrary code execution via a crafted whois record | critical | 9.8 | 6% |
| CVE-2026-44262 | dedoc/scramble | Scramble vulnerable to remote code execution via evaluation of user-controlled input in validation rules | critical | 9.4 | 6% |
| CVE-2024-28116 | getgrav/grav | Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass | high | 8.8 | 6% |
| CVE-2010-4879 | dompdf/dompdf | DOMPDF Remote File Inclusion Vulnerability | high | 0.0 | 5% |
| CVE-2015-9272 | video-presentation (WordPress plugin) | The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php | critical | 9.8 | 5% |
| CVE-2022-29221 | smarty/smarty | PHP Code Injection by malicious block or filename in Smarty | high | 8.8 | 5% |
| CVE-2021-29472 | composer/composer | Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial | high | 8.8 | 5% |
| CVE-2018-14630 | moodle/moodle | Moodle XML import of ddwtos could lead to intentional remote code execution | high | 8.8 | 5% |
| CVE-2019-15647 | groundhogg (WordPress plugin) | The groundhogg plugin before 1.3.5 for WordPress has wp-admin/admin-ajax.php?action=bulk_action_listener remote code execution. | high | 8.8 | 5% |
| CVE-2014-5013 | dompdf/dompdf | DOMPDF Remote Code Execution | high | 8.8 | 4% |
| CVE-2024-11613 | wordpress-file-upload (WordPress plugin) | The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrary File Deletion in a | critical | 9.8 | 4% |
| CVE-2026-42607 | getgrav/grav | Grav Vulnerable to Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature | critical | 9.1 | 4% |
| CVE-2018-11587 | centreon/centreon | Centreon RCE Vulnerability | critical | 9.8 | 4% |
| CVE-2025-34086 | bolt/bolt | Bolt CMS vulnerable to authenticated remote code execution | high | 0.0 | 4% |
| CVE-2018-18461 | bft-autoresponder (WordPress plugin) | The Arigato Autoresponder and Newsletter (aka bft-autoresponder) v2.5.1.7 plugin for WordPress allows remote attackers to execute arbitrary | critical | 9.8 | 4% |
| CVE-2016-6633 | phpmyadmin/phpmyadmin | phpMyAdmin Remote code execution vulnerability when PHP is running with dbase extension | high | 8.1 | 4% |
| CVE-2021-33816 | dolibarr/dolibarr | Dolibarr remote PHP code execution | critical | 9.8 | 4% |
| CVE-2023-0877 | froxlor/froxlor | Code Injection in froxlor/froxlor | high | 8.8 | 4% |
| CVE-2011-4932 | impresspages/impresspages | ImpressPages CMS eval injection vulnerability | high | 0.0 | 4% |
| CVE-2019-11832 | typo3/cms, typo3/cms-core | TYPO3 Image Processing susceptible to Code Execution | high | 7.5 | 4% |
| CVE-2019-15873 | profilegrid-user-profiles-groups-and-communities (WordPress plugin) | The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax. | high | 8.8 | 4% |
| CVE-2018-16975 | elefant/cms | Elefant CMS PHP Code Execution Vulnerability | critical | 9.8 | 4% |
| CVE-2014-3541 | moodle/moodle | Moodle vulnerable to PHP object injection attacks | high | 0.0 | 4% |
| CVE-2021-40219 | bolt/core | Code Injection in Bolt CMS | high | 8.8 | 3% |
| CVE-2015-3173 | custom-content-type-manager (WordPress plugin) | custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution. | high | 7.2 | 3% |
| CVE-2016-3171 | drupal/core, drupal/drupal | Drupal arbitrary code execution | high | 8.1 | 3% |
| CVE-2014-8350 | smarty/smarty | Smarty arbitrary PHP code execution | high | 0.0 | 3% |
| CVE-2017-1000480 | smarty/smarty | Smarty PHP code injection | critical | 9.8 | 3% |
| CVE-2003-1599 | WordPress core | PHP remote file inclusion vulnerability in wp-links/links.all.php in WordPress 0.70 allows remote attackers to execute arbitrary PHP code vi | high | 7.5 | 3% |
| CVE-2022-3383 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_v | high | 7.2 | 3% |
| CVE-2022-3384 | ultimate-member (WordPress plugin) | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dro | high | 7.2 | 3% |
| CVE-2009-3631 | typo3/cms-backend | TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name | high | 0.0 | 3% |
| CVE-2017-11675 | zencart/zencart | Authenticated RCE in Zen Cart 1.5.5e | high | 8.8 | 3% |
| CVE-2021-27903 | craftcms/cms | Craft CMS Remote Code Injection | critical | 9.8 | 3% |
| CVE-2025-66294 | getgrav/grav | Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass | high | 0.0 | 3% |
| CVE-2021-34551 | phpmailer/phpmailer | Remote Code Execution vulnerability in PHPMailer 6.4.1 running on Windows | high | 8.1 | 3% |
| CVE-2024-7627 | file-manager (WordPress plugin) | The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. Th | high | 8.1 | 3% |
| CVE-2013-0724 | wp-ecommerce-shop-styling (WordPress plugin) | PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows | high | 7.5 | 3% |
| CVE-2018-20717 | prestashop/prestashop | PrestaShop PHP Object Injection | high | 8.8 | 3% |
| CVE-2022-24665 | php-everywhere (WordPress plugin) | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able | critical | 9.9 | 3% |
| CVE-2023-2359 | slider-revolution (WordPress plugin) | The Slider Revolution WordPress plugin through 6.6.12 does not check for valid image files upon import, leading to an arbitrary file upload | high | 8.8 | 3% |
| CVE-2015-2171 | slim/slim | Slim vulnerable to PHP object injection | high | 0.0 | 2% |