Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-56145 KEV | craftcms/cms | Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled | critical | 9.8 | 97% |
| CVE-2019-9194 | studio-42/elfinder | elFinder command injection vulnerability in the PHP connector | critical | 9.8 | 97% |
| CVE-2023-30253 | dolibarr/dolibarr | Dolibarr vulnerable to remote code execution via uppercase manipulation | high | 8.8 | 82% |
| CVE-2018-15877 | plainview-activity-monitor (WordPress plugin) | The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip | high | 8.8 | 77% |
| CVE-2018-20434 | librenms/librenms | LibreNMS arbitrary OS commands execution | critical | 9.8 | 71% |
| CVE-2021-32682 | studio-42/elfinder | elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE | critical | 9.8 | 70% |
| CVE-2022-0557 | microweber/microweber | OS Command Injection in Microweber | high | 7.8 | 51% |
| CVE-2023-7002 | backup-backup (WordPress plugin) | The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the 'url' p | high | 7.2 | 31% |
| CVE-2019-15715 | mantisbt/mantisbt | MantisBT Remote Code Execution | high | 7.2 | 30% |
| CVE-2023-38886 | dolibarr/dolibarr | Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script | high | 7.2 | 30% |
| CVE-2019-25224 | wp-database-backup (WordPress plugin) | The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function. This vu | critical | 9.8 | 22% |
| CVE-2022-2314 | vr-calendar (WordPress plugin) | The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site. | critical | 9.8 | 18% |
| CVE-2021-3291 | zencart/zencart | Zen Cart vulnerable to authenticated remote code execution | high | 7.2 | 17% |
| CVE-2026-33478 | wwbn/avideo | AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection | critical | 10.0 | 13% |
| CVE-2026-29058 | wwbn/avideo | WWBN AVideo is vulnerable to unauthenticated OS Command Injection via base64Url in objects/getImage.php | critical | 9.8 | 9% |
| CVE-2026-48030 | pheditor/pheditor | Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter | critical | 9.9 | 8% |
| CVE-2017-11366 | codiad/codiad | Codiad Vulnerable to Shell Command Injection | critical | 9.8 | 8% |
| CVE-2026-6204 | librenms/librenms | LibreNMS is Vulnerable to Remote Code Execution by Arbitrary File Write | high | 0.0 | 8% |
| CVE-2024-51092 | librenms/librenms | LibreNMS has an Authenticated OS Command Injection | critical | 9.1 | 7% |
| CVE-2020-9576 | magento/community-edition, magento/core, magento/project-community-edition | Magento command injection vulnerability | critical | 9.8 | 6% |
| CVE-2020-9578 | magento/community-edition, magento/core, magento/project-community-edition | Magento command injection vulnerability | critical | 9.8 | 6% |
| CVE-2020-9582 | magento/community-edition, magento/core, magento/project-community-edition | Magento command injection vulnerability | critical | 9.8 | 6% |
| CVE-2020-9583 | magento/community-edition, magento/core, magento/project-community-edition | Magento command injection vulnerability | critical | 9.8 | 6% |
| CVE-2020-13252 | centreon/centreon | Command Injection in Centreon | high | 8.8 | 5% |
| CVE-2023-30854 | wwbn/avideo | Remote code injection in wwbn/avideo | high | 8.8 | 5% |
| CVE-2015-5237 | google/protobuf | protobuf susceptible to buffer overflow | high | 8.8 | 5% |
| CVE-2021-21016 | magento/community-edition, magento/project-community-edition | Magento OS command injection via the WebAPI | critical | 9.1 | 5% |
| CVE-2019-10774 | mikehaertl/php-shellcommand | php-shellcommand command injection vulnerability | critical | 9.8 | 5% |
| CVE-2026-33482 | wwbn/avideo | AVideo has an OS Command Injection via $() Shell Substitution Bypass in sanitizeFFmpegCommand() | high | 8.1 | 4% |
| CVE-2021-24684 | pdf-light-viewer (WordPress plugin) | The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the s | high | 8.8 | 4% |
| CVE-2021-21018 | magento/community-edition | Magento OS Command Injection | critical | 9.1 | 4% |
| CVE-2017-1000009 | akeneo/pim-community-dev | Akeneo PIM vulnerable to shell injection in the mass edition | critical | 9.8 | 4% |
| CVE-2020-22345 | centreon/centreon | OS Command Injection in Centreon | high | 8.8 | 4% |
| CVE-2024-20720 | magento/community-edition, magento/project-community-edition | Magento Open Source allows OS Command Injection | critical | 9.1 | 4% |
| CVE-2014-8334 | wp-dbmanager (WordPress plugin) | The WP-DBManager (aka Database Manager) plugin before 2.7.2 for WordPress allows remote authenticated users to execute arbitrary commands vi | medium | 6.5 | 3% |
| CVE-2021-36022 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the Widgets Update Layout | high | 7.2 | 3% |
| CVE-2009-0258 | typo3/cms | Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection | high | 0.0 | 3% |
| CVE-2019-8159 | magento/community-edition, magento/product-community-edition | Magento 2 Community Edition RCE Vulnerability | high | 8.8 | 3% |
| CVE-2021-21015 | magento/community-edition | Magento OS command injection via the customer attribute save controller | high | 8.0 | 3% |
| CVE-2021-36024 | magento/community-edition, magento/project-community-edition | Magento is affected by an os command injection via the Data collection endpoint | high | 7.2 | 3% |
| CVE-2026-55173 | wwbn/avideo | AVideo has an incomplete fix of CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving OS command exe | high | 8.1 | 3% |
| CVE-2023-38208 | magento/community-edition, magento/project-community-edition | Magento Open Source allows Improper Neutralization of Special Elements Used | critical | 9.1 | 3% |
| CVE-2026-56700 | getgrav/grav | Grav has multiple RCE vectors: unsafe unserialize (x3), command injection in git clone, SSTI blocklist bypass | critical | 0.0 | 3% |
| CVE-2020-19316 | laravel/framework | OS Command Injection in Laravel Framework | high | 8.8 | 3% |
| CVE-2021-20682 | baserproject/basercms | OS Command Injection in baserCMS | high | 7.2 | 2% |
| CVE-2021-36023 | magento/community-edition, magento/project-community-edition | Magento XML Injection vulnerability in the Widgets Update Layout | critical | 9.1 | 2% |
| CVE-2021-37708 | shopware/core, shopware/platform | Command injection in mail agent settings | high | 8.8 | 2% |
| CVE-2024-6486 | imagemagick-engine (WordPress plugin) | The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "cli_pa | high | 7.2 | 2% |
| CVE-2026-21861 | baserproject/basercms | baserCMS has OS Command Injection Leading to Remote Code Execution (RCE) | critical | 9.1 | 2% |
| CVE-2026-41304 | wwbn/avideo | WWBN AVideo: RCE cause by clonesite plugin | critical | 9.8 | 2% |