Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2013-2083 | moodle/moodle | Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class | medium | 0.0 | 2% |
| CVE-2012-1608 | typo3/cms | Typo3 API XSS Vulnerabilities | medium | 0.0 | 2% |
| CVE-2021-36030 | magento/community-edition, magento/project-community-edition | Magento allows attackers to alter the price of items | high | 0.0 | 2% |
| CVE-2013-2202 | WordPress core | WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity dec | medium | 4.3 | 2% |
| CVE-2019-18888 | symfony/http-foundation, symfony/mime, symfony/symfony | Argument injection in a MimeTypeGuesser in Symfony | high | 7.5 | 2% |
| CVE-2021-36032 | magento/community-edition, magento/project-community-edition | Magento is affected by an improper input validation vulnerability | high | 8.8 | 2% |
| CVE-2020-15098 | typo3/cms, typo3/cms-core | Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS | high | 8.8 | 2% |
| CVE-2016-6212 | drupal/core, drupal/drupal | Drupal Views can allow unauthorized users to see Statistics information | medium | 5.3 | 2% |
| CVE-2011-3126 | WordPress core | WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects. | medium | 5.0 | 2% |
| CVE-2023-49282 | microsoft/microsoft-graph | Test code in published microsoft-graph package exposes phpinfo() | medium | 5.4 | 2% |
| CVE-2023-49283 | microsoft/microsoft-graph-core | Test code in published microsoft-graph-core package exposes phpinfo() | medium | 5.4 | 2% |
| CVE-2016-9263 | WordPress core | WordPress through 4.8.2, when domain-based flashmediaelement.swf sandboxing is not used, allows remote attackers to conduct cross-domain Fla | medium | 4.7 | 2% |
| CVE-2017-1000014 | phpmyadmin/phpmyadmin | phpMyAdmin DoS Vulnerability | high | 7.5 | 2% |
| CVE-2014-100009 | js-multi-hotel (WordPress plugin) | The Joomlaskin JS Multi Hotel (aka JS MultiHotel and Js-Multi-Hotel) plugin 2.2.1 and earlier for WordPress allows remote attackers to obtai | medium | 5.0 | 2% |
| CVE-2017-5223 | phpmailer/phpmailer | Local file disclosure in PHPMailer | medium | 5.5 | 2% |
| CVE-2025-69200 | thorsten/phpmyfaq | phpMyFAQ has unauthenticated config backup download via /api/setup/backup | high | 7.5 | 2% |
| CVE-2015-1000008 | mp3-jplayer (WordPress plugin) | Path Disclosure Vulnerability in wordpress plugin MP3-jPlayer v2.3.2 | medium | 5.3 | 2% |
| CVE-2011-4283 | moodle/moodle | Moodle allows remote attackers to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2011-4284 | moodle/moodle | Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context page | medium | 0.0 | 2% |
| CVE-2014-7848 | moodle/moodle | Moodle allows attacks to obtain sensitive information | medium | 0.0 | 2% |
| CVE-2014-9060 | moodle/moodle | Moodle allows attackers to trigger the generation of arbitrary messages | medium | 0.0 | 2% |
| CVE-2017-17898 | dolibarr/dolibarr | Dolibarr sensitive information disclosure | high | 7.5 | 2% |
| CVE-2021-29450 | WordPress core | Wordpress is an open source CMS. One of the blocks in the WordPress editor can be exploited in a way that exposes password-protected posts a | medium | 6.5 | 2% |
| CVE-2016-3170 | drupal/core, drupal/drupal | Drupal sensitive information disclosure | medium | 5.3 | 2% |
| CVE-2013-7483 | slidedeck2 (WordPress plugin) | The slidedeck2 plugin before 2.3.5 for WordPress has file inclusion. | critical | 9.8 | 2% |
| CVE-2020-24406 | magento/community-edition | Magento information disclosure vulnerability | low | 3.7 | 2% |
| CVE-2021-21408 | smarty/smarty | Access to restricted PHP code by dynamic static class access in smarty | high | 8.8 | 2% |
| CVE-2014-10384 | memphis-documents-library (WordPress plugin) | The memphis-documents-library plugin before 3.0 for WordPress has Local File Inclusion. | critical | 9.8 | 2% |
| CVE-2018-10891 | moodle/moodle | Moodle XSS Vulnerability | high | 7.3 | 2% |
| CVE-2018-19456 | wpbackupplus (WordPress plugin) | The WP Backup+ (aka WPbackupplus) plugin through 2018-11-22 for WordPress allows remote attackers to obtain sensitive information from serve | high | 7.5 | 2% |
| CVE-2023-6266 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to unauthorized access of data due to insufficient path and file validation on the B | high | 7.5 | 2% |
| CVE-2018-10890 | moodle/moodle | Moodle Exposure of Sensitive Information to an Unauthorized Actor | medium | 5.3 | 2% |
| CVE-2019-12474 | mediawiki/core | Wikimedia information leak vulnerability | high | 7.5 | 2% |
| CVE-2024-1210 | learndash (WordPress plugin) | The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via API. | medium | 5.3 | 2% |
| CVE-2016-10930 | wp-support-plus-responsive-ticket-system (WordPress plugin) | The wp-support-plus-responsive-ticket-system plugin before 7.1.0 for WordPress has insecure direct object reference via a ticket number. | critical | 9.8 | 2% |
| CVE-2021-36044 | magento/community-edition, magento/project-community-edition | Magento affected by a server-side denial-of-service using a GraphQL field | high | 7.5 | 2% |
| CVE-2021-36021 | magento/community-edition, magento/project-community-edition | Magento affected by remote code execution vulnerability in the CMS page scheduled update feature | critical | 9.1 | 2% |
| CVE-2019-9826 | phpbb/phpbb | phpBB Denial of Service | high | 7.5 | 2% |
| CVE-2013-2694 | wp-symposium (WordPress plugin) | Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitr | medium | 5.8 | 2% |
| CVE-2022-31042 | guzzlehttp/guzzle, drupal/core | Failure to strip the Cookie header on change in host or HTTP downgrade | high | 7.5 | 2% |
| CVE-2015-8476 | phpmailer/phpmailer | SMTP Injection in PHPMailer | low | 0.0 | 2% |
| CVE-2020-12070 | advanced-woo-search (WordPress plugin) | The Advanced Woo Search plugin version through 1.99 for Wordpress suffers from a sensitive information disclosure vulnerability in every aja | high | 7.5 | 2% |
| CVE-2021-39200 | WordPress core | WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versio | medium | 5.3 | 2% |
| CVE-2018-20973 | companion-auto-update (WordPress plugin) | The companion-auto-update plugin before 3.2.1 for WordPress has local file inclusion. | critical | 9.8 | 2% |
| CVE-2019-7885 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 2% |
| CVE-2014-8491 | grand-flagallery (WordPress plugin) | The Grand Flagallery plugin before 4.25 for WordPress allows remote attackers to obtain the installation path via a request to (1) flagaller | medium | 5.3 | 2% |
| CVE-2016-0724 | moodle/moodle | Moodle sensitive information disclosure | medium | 4.3 | 2% |
| CVE-2016-9863 | phpmyadmin/phpmyadmin | phpMyAdmin DoS Vulnerability | high | 7.5 | 2% |
| CVE-2016-9860 | phpmyadmin/phpmyadmin | phpMyAdmin Denial of Service (DoS) | medium | 5.9 | 2% |
| CVE-2019-14365 | intercom (WordPress plugin) | The Intercom plugin through 1.2.1 for WordPress leaks a Slack Access Token in source code. An attacker can obtain a lot of information about | high | 7.5 | 2% |