Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2026-40909 | wwbn/avideo | WWBN AVideo has a Path Traversal in Locale Save Endpoint Enables Arbitrary PHP File Write to Any Web-Accessible Directory (RCE) | high | 8.7 | 1% |
| CVE-2025-49559 | magento/community-edition, magento/project-community-edition | Magento vulnerable to path traversal | medium | 5.3 | 1% |
| CVE-2024-48224 | funadmin/funadmin | SQL injection in funadmin | high | 7.5 | 1% |
| CVE-2024-42718 | croogo/croogo | Croogo CMS has a path traversal vulnerability | high | 7.5 | 1% |
| CVE-2024-43440 | moodle/moodle | Moodle LFI vulnerability when restoring malformed block backups | high | 7.5 | 1% |
| CVE-2023-38708 | pimcore/pimcore | Pimcore Path Traversal Vulnerability in AssetController:importServerFilesAction | medium | 6.3 | 1% |
| CVE-2025-0822 | bit-assist (WordPress plugin) | Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This m | medium | 6.5 | 1% |
| CVE-2024-47049 | czim/file-handling | czim/file-handling vulnerable to SSRF and directory traversal | high | 8.2 | 1% |
| CVE-2026-63222 | codeigniter4/framework | CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames | high | 7.5 | 1% |
| CVE-2026-72695 | getgrav/grav | Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion | high | 8.1 | 1% |
| CVE-2019-15648 | insert-or-embed-articulate-content-into-wordpress (WordPress plugin) | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam | medium | 6.5 | 1% |
| CVE-2026-28695 | craftcms/cms | Craft CMS Vulnerable to Authenticated RCE via Twig SSTI - create() function + Symfony Process gadget | medium | 0.0 | 1% |
| CVE-2024-37499 | online-booking-\&-scheduling-calendar (WordPress plugin) | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in vCita Online Booking & Scheduling Calendar f | medium | 6.5 | 1% |
| CVE-2024-13538 | bigbuy-wc-dropshipping-connector (WordPress plugin) | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and incl | medium | 5.3 | 1% |
| CVE-2026-41203 | ci4-cms-erp/ci4ms | CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE | critical | 0.0 | 1% |
| CVE-2024-3107 | ultimate-addons-for-gutenberg (WordPress plugin) | The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via t | medium | 4.3 | 1% |
| CVE-2025-24019 | yeswiki/yeswiki | Authenticated arbitrary file deletion in YesWiki | high | 7.1 | 1% |
| CVE-2024-26129 | prestashop/prestashop | Path disclosure in JavaScript variable | medium | 5.8 | 1% |
| CVE-2024-43434 | moodle/moodle | Moodle has CSRF risk in Feedback non-respondents report | high | 8.1 | 1% |
| CVE-2025-44163 | billz/raspap-webgui | raspap-webgui has a Directory Traversal vulnerability | high | 0.0 | 1% |
| CVE-2026-42608 | getgrav/grav | Grav has Unauthenticated Path Traversal & Arbitrary File Write in its FormFlash component | high | 0.0 | 1% |
| CVE-2021-24761 | error-log-viewer (WordPress plugin) | The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal pr | medium | 6.5 | 1% |
| CVE-2024-2203 | the-plus-addons-for-elementor-page-builder (WordPress plugin) | The The Plus Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.4.1 via | medium | 6.4 | 1% |
| CVE-2022-25773 | mautic/core | Mautic allows Relative Path Traversal in assets file upload | medium | 4.3 | 1% |
| CVE-2025-31493 | getkirby/cms | Kirby vulnerable to path traversal of collection names during file system lookup | medium | 0.0 | 1% |
| CVE-2026-55469 | snipe/snipe-it | Snipe-IT has a path traversal vulnerability via CSV import `image` field | low | 0.0 | 1% |
| CVE-2022-2184 | captcha-4wp (WordPress plugin) | The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This c | high | 8.8 | 1% |
| CVE-2025-30207 | getkirby/cms | Kirby vulnerable to path traversal in the router for PHP's built-in server | low | 0.0 | 1% |
| CVE-2024-29196 | phpmyfaq/phpmyfaq | phpMyFAQ Path Traversal in Attachments | low | 3.8 | 1% |
| CVE-2026-9559 | mautic/core | Mautic vulnerable to Path Traversal via Campaign Import | critical | 9.9 | 1% |
| CVE-2024-52600 | statamic/cms | Statamic CMS has a Path Traversal in Asset Upload | medium | 5.3 | 1% |
| CVE-2026-33183 | saloonphp/saloon | Saloon has a Fixture Name Path Traversal Vulnerability | medium | 0.0 | 1% |
| CVE-2024-42485 | pxlrbt/filament-excel | Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint | high | 7.5 | 1% |
| CVE-2026-54178 | backpack/crud | Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk | high | 8.1 | 1% |
| CVE-2024-8538 | tuxedo-big-file-uploads (WordPress plugin) | The Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, a | medium | 4.3 | 1% |
| CVE-2026-33686 | code16/sharp | Sharp is Vulnerable to Path Traversal via Unsanitized Extension in FileUtil | high | 8.8 | 1% |
| CVE-2025-65345 | alexusmai/laravel-file-manager | alexusmai laravel-file-manager is vulnerable to Directory Traversal | low | 0.0 | 1% |
| CVE-2025-66295 | getgrav/grav | Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption | high | 8.8 | 1% |
| CVE-2025-1026 | spatie/browsershot | Browsershot Local File Inclusion | high | 8.6 | 1% |
| CVE-2025-8081 | elementor (WordPress plugin) | The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images:: | medium | 4.9 | 1% |
| CVE-2024-13671 | music-sheet-viewer (WordPress plugin) | The Music Sheet Viewer plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.1 via the read_scor | high | 7.5 | 1% |
| CVE-2025-3295 | wp-editor (WordPress plugin) | The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1. This makes it possibl | medium | 4.9 | 1% |
| CVE-2026-21857 | redaxo/source | Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read | high | 0.0 | 1% |
| CVE-2024-8291 | concrete5/concrete5 | Cross site scripting in Concrete CMS | medium | 4.8 | 1% |
| CVE-2026-62992 | smarty/smarty | Smarty: Symlink path traversal out of trusted directories | medium | 0.0 | 1% |
| CVE-2024-13535 | actionwear-products-sync (WordPress plugin) | The Actionwear products sync plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.3.2. This is | medium | 5.3 | 1% |
| CVE-2025-2048 | lana-downloads-manager (WordPress plugin) | The Lana Downloads Manager WordPress plugin before 1.10.0 does not validate user input used in a path, which could allow users with an admin | medium | 4.1 | 1% |
| CVE-2024-13720 | wp-image-uploader (WordPress plugin) | The WP Image Uploader plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the gky_imag | high | 8.8 | 1% |
| CVE-2026-12198 | microweber/microweber | Microweber vulnerable to Path Traversal | high | 7.3 | 1% |
| CVE-2025-49138 | elmsln/haxcms | HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter | medium | 6.5 | 1% |