Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-34102 KEV | magento/community-edition, magento/product-community-edition | Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability | critical | 9.8 | 100% |
| CVE-2021-29447 | WordPress core | Wordpress is an open source CMS. A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Libr | high | 7.1 | 86% |
| CVE-2012-3363 | zendframework/zendframework1 | Zend Framework XXE Vulnerability | high | 7.3 | 49% |
| CVE-2022-2633 | all-in-one-video-gallery (WordPress plugin) | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'd | high | 7.5 | 34% |
| CVE-2017-18357 | shopware/shopware | Shopware XXE Vulnerability | medium | 6.5 | 27% |
| CVE-2011-4107 | phpmyadmin/phpmyadmin | phpMyAdmin vulnerable to XML external entity (XXE) injection attack | medium | 6.5 | 13% |
| CVE-2012-4399 | cakephp/cakephp | CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references | high | 7.5 | 12% |
| CVE-2015-5161 | zendframework/zendframework, zendframework/zendframework1, zendframework/zendxml | ZendXml and Zend Framework contain XXE and XEE Vulnerabilities | medium | 0.0 | 10% |
| CVE-2023-30943 | moodle/moodle | Moodle External Control of File Name or Path vulnerability | medium | 5.3 | 7% |
| CVE-2014-2053 | james-heinrich/getid3 | getID3 is vulnerable to XML External Entity (XXE) | high | 0.0 | 5% |
| CVE-2022-2431 | download-manager (WordPress plugin) | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to i | high | 8.1 | 4% |
| CVE-2021-3311 | october/rain | October CMS Session ID not invalidated after logout | critical | 9.8 | 3% |
| CVE-2024-45293 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet's XLSX reader | high | 7.5 | 3% |
| CVE-2014-2681 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 3% |
| CVE-2020-25911 | modx/revolution | XML External Entity vulnerability in MODX CMS | critical | 9.1 | 2% |
| CVE-2014-2683 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2014-2682 | zendframework/zendframework1, zendframework/zendopenid, zendframework/zendrest +7 more | Several Zend Products Vulnerable to XXE and XEE attacks | medium | 0.0 | 2% |
| CVE-2018-14065 | phpoffice/common | PHPOffice Common Improper Restriction of XML External Entity Reference | critical | 9.8 | 2% |
| CVE-2012-5657 | zendframework/zendframework1 | Zend Framework XXE Vulnerability | medium | 0.0 | 2% |
| CVE-2023-38490 | getkirby/cms | XML External Entity (XXE) vulnerability in the XML data handler | medium | 6.8 | 2% |
| CVE-2021-21031 | magento/community-edition, magento/project-community-edition | Magento Insufficient Session Expiration | medium | 5.6 | 2% |
| CVE-2015-3907 | chriskacerguis/codeigniter-restserver | CodeIgniter Rest Server XXE Vulnerability | critical | 9.8 | 2% |
| CVE-2018-11386 | symfony/http-foundation, symfony/symfony | Symfony DoS | medium | 5.9 | 2% |
| CVE-2021-21032 | magento/community-edition, magento/project-community-edition | Magento Insufficient Session Expiration | medium | 5.6 | 2% |
| CVE-2014-2054 | phpoffice/phpexcel | PHPExcel vulnerable to XXE attacks through libxml | medium | 0.0 | 2% |
| CVE-2020-5296 | october/cms | Arbitrary File Deletion vulnerability in OctoberCMS | medium | 6.2 | 1% |
| CVE-2014-3543 | moodle/moodle | Moodle Arbitrary File Read via XML External Entity vulnerability | medium | 0.0 | 1% |
| CVE-2019-12331 | phpoffice/phpexcel, phpoffice/phpspreadsheet | XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue | high | 8.8 | 1% |
| CVE-2016-0796 | mb.miniaudioplayer (WordPress plugin) | WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for your mp3 files is prone to multiple vulnerabilities, including open proxy and | high | 7.5 | 1% |
| CVE-2022-31050 | typo3/cms, typo3/cms-core | Insufficient Session Expiration in TYPO3's Admin Tool | medium | 6.0 | 1% |
| CVE-2022-2713 | aheinze/cockpit | Cockpit before 2.2.0 vulnerable to Insufficient Session Expiration | critical | 9.8 | 1% |
| CVE-2022-24743 | sylius/sylius | Insufficient Session Expiration in Sylius | high | 7.1 | 1% |
| CVE-2017-12867 | simplesamlphp/simplesamlphp | SimpleSAMLphp Invalid token creation and validation | medium | 5.9 | 1% |
| CVE-2022-2638 | export-all-urls (WordPress plugin) | The Export All URLs WordPress plugin before 4.4 does not validate the path of the file to be removed on the system which is supposed to be t | medium | 6.5 | 1% |
| CVE-2020-5297 | october/cms | Upload whitelisted files to any directory in OctoberCMS | low | 3.4 | 1% |
| CVE-2020-25750 | devgroup/dotplant | DotPlant2 Improper Restriction of XML External Entity Reference | high | 7.5 | 1% |
| CVE-2017-1000046 | mautic/core | Sensitive Cookie Without HttpOnly and Secure Flag | high | 7.5 | 1% |
| CVE-2017-1000477 | desperado/xml-bundle | XXE Vulnerability in XMLBundle 0.1.7 | high | 7.5 | 1% |
| CVE-2025-6691 | sureforms (WordPress plugin) | The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f | high | 8.1 | 1% |
| CVE-2022-0991 | admidio/admidio | Insufficient Session Expiration in Admidio | high | 8.2 | 1% |
| CVE-2022-1155 | snipe/snipe-it | Old sessions not blocked by login enable function in Snipe-IT | high | 7.4 | 1% |
| CVE-2024-52596 | simplesamlphp/xml-common | SimpleSAMLphp xml-common XXE vulnerability | high | 0.0 | 1% |
| CVE-2020-8226 | phpbb/phpbb | phpBB Server-Side Request Forgery Vulnerability | medium | 5.8 | 1% |
| CVE-2021-3902 | dompdf/dompdf | Improper Restriction of XML External Entity Reference in dompdf/dompdf | critical | 9.8 | 1% |
| CVE-2024-25117 | phenx/php-svg-lib | php-svg-lib lacks path validation on font through SVG inline styles | medium | 6.8 | 1% |
| CVE-2019-8126 | magento/community-edition, magento/product-community-edition | Information disclosure through processing of external XML entities | medium | 4.9 | 1% |
| CVE-2021-32710 | shopware/platform | Potential Session Hijacking | low | 0.0 | 1% |
| CVE-2009-20001 | mantisbt/mantisbt | MantisBT Insufficient Session Expiration cookie string not reset after logout | high | 8.1 | 1% |
| CVE-2015-10029 | kelvinmo/simplexrd | kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference | critical | 9.8 | 1% |
| CVE-2020-25817 | silverstripe/framework | SilverStripe XXE Vulnerability in CSSContentParser | medium | 4.8 | 1% |