phpwarden
FeaturesComparePricingAdvisoriesBlogDocsChangelogLog in
Log inStart free

PHP vulnerability advisories

Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.

19,303CVEs
8,638Composer advisories
12,328WordPress advisories
35Actively exploited (KEV) →
CVEPackageTitleSeverityCVSSEPSS
CVE-2024-11956pimcore/customer-management-framework-bundlepimcore/customer-data-framework vulnerable to SQL Injectionhigh7.21%
CVE-2025-0959eventer (WordPress plugin)The Eventer - WordPress Event & Booking Manager Plugin plugin for WordPress is vulnerable to SQL Injection via the reg_id parameter in all vhigh8.80%
CVE-2026-22242coreshop/core-shopCoreShop Vulnerable to SQL Injection via Admin Reportsmedium4.90%
CVE-2026-23959coreshop/core-shopCoreShop Vulnerable to SQL Injection via Admin customer-company-modifiermedium0.00%
Page 1 of 1 · 4 advisories
Severity and CVSS come from the upstream advisory (OSV.dev, NVD, FriendsOfPHP); KEV marks CVEs on CISA's Known Exploited Vulnerabilities list; EPSS is FIRST's 30-day exploitation probability. Rows sort exploitation-first: KEV, then EPSS, then CVSS.