PHP CMS Project maintains a narrowly scoped content-management system with a small but measurable presence in the vulnerability landscape. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Php Cms Project over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-19127CRITICAL A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary co | Nov 9, 2018 | 9.8 | 51 | NO | YES |
CVE-2011-0645HIGH SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where_time parameter in a get action. | Jan 25, 2011 | 7.5 | 32 | NO | YES |
CVE-2011-0644HIGH SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flash_up | Jan 25, 2011 | 7.5 | 32 | NO | YES |
CVE-2022-26613CRITICAL PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php. | Apr 6, 2022 | 9.8 | 31 | NO | NO |
CVE-2006-3019HIGH Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in | Jun 15, 2006 | 7.5 | 31 | NO | YES |
CVE-2008-0513HIGH Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter | Jan 31, 2008 | 7.8 | 30 | NO | YES |
CVE-2020-22203CRITICAL SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php. | Jun 16, 2021 | 9.8 | 28 | NO | NO |
CVE-2020-22199CRITICAL SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php. | Jun 16, 2021 | 9.8 | 28 | NO | NO |
CVE-2018-14399CRITICAL libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI in the SRC attribute of an IMG element w | Jul 19, 2018 | 9.8 | 28 | NO | NO |
CVE-2020-22201HIGH phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php. | Jun 16, 2021 | 8.8 | 27 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Php Cms Project.
Media articles that mention a CVE ID that affects a product developed by Php Cms Project — matched by CVE ID, not by vendor name.