Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.30.1, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| GHSA-qf36-fx9f-232x | zendframework/zendframework1 | ZendFramework potential SQL Injection Vector When Using PDO_MySql | critical | 9.8 | – |
| GHSA-v3mr-gp7j-pw5w | terminal42/contao-tablelookupwizard | Possible SQL injection in tablelookupwizard Contao Extension | critical | 9.8 | – |
| GHSA-v42g-7q2x-cw32 | zendframework/zendframework1 | Zendframework1 potential SQL injection vector using null byte for PDO (MsSql, SQLite) | critical | 9.8 | – |
| CVE-2026-33944 | dolibarr/dolibarr | Dolibarr has SQL Injection in societe/class/societe.class.php via localtax1_value parameter | high | 8.8 | – |
| GHSA-265q-222x-52m6 | silverstripe/framework | silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector | high | 8.8 | – |
| GHSA-x2f4-8wxf-w3vf | zendframework/zendframework | ZendFramework SQL injection due to execution of platform-specific SQL containing interpolations | high | 8.8 | – |
| GHSA-xc69-p8fc-m6m5 | silverstripe/subsites | silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source) | high | 8.8 | – |
| GHSA-xx4r-5265-48j6 | silverstripe/framework | silverstripe/framework SQL injection in full text search | high | 8.8 | – |
| GHSA-45wj-jv2h-jwrf | typo3/cms-core | TYPO3 CMS Privilege Escalation and SQL Injection | high | 7.5 | – |
| GHSA-p2v5-xcqm-4fv6 | silverstripe/taxonomy | silverstripe/taxonomy SQL Injection vulnerability | high | 7.5 | – |
| CVE-2026-38739 | ezsystems/ezpublish-legacy | ezsystems/ezpublish-legacy has a SQL injection in dfscleanup | high | 7.1 | – |
| GHSA-j86x-pjmr-9m6w | typo3/cms | SQL Injection in TYPO3 Frontend Login | medium | 5.4 | – |
| CVE-2026-47142 | mantisbt/mantisbt | MantisBT: SQL Injection via history_order Configuration Value | high | 0.0 | – |
| GHSA-4mg9-vhxq-vm7j | illuminate/database, laravel/framework | SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database | high | 0.0 | – |
| GHSA-h63c-xvpf-264j | adodb/adodb-php | ADOdb SQL injection vulnerability | critical | 0.0 | – |
| GHSA-jpwx-ffjq-wr4w | ezsystems/ezpublish-legacy | Content object state fetch functions open to SQL injection | high | 0.0 | – |
| GHSA-v4q9-437p-mhpg | leantime/leantime | Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi) | high | 0.0 | – |
| GHSA-wq8p-mqvg-2p5h | laravel/framework | laravel framework SQL Injection via limit and offset functions | high | 0.0 | – |