Php Cms
Vendor:
First CVE: Jan 10, 2005 · Active for 21 years
18
Total CVEs
More Total CVEs than 49% of tracked products
2.3
Avg CVEs / Year
Bottom 1%
7.4
Avg CVSS
Higher Avg CVSS than 77% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Php Cms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 10, 2005
21 years ago
Most Recent CVE
Feb 20, 2025
519 days ago
CVE Severity & Scoring
Php Cms18 CVEs
44%
28%
28%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network13 (72.2%)
Unknown5 (27.8%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low13 (72.2%)
High0 (0.0%)
Unknown5 (27.8%)
User Interaction
None9 (50.0%)
Unknown5 (27.8%)
Required4 (22.2%)
Privileges Required
Low2 (11.1%)
High1 (5.6%)
None10 (55.6%)
Unknown5 (27.8%)
Top CVEs
Signals from CVEs in this product scope (18 CVEs).
18 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-19127CRITICAL A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary co | Nov 9, 2018 | 9.8 | 51 | NO | YES |
CVE-2022-26613CRITICAL PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php. | Apr 6, 2022 | 9.8 | 31 | NO | NO |
CVE-2006-3019HIGH Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in | Jun 15, 2006 | 7.5 | 31 | NO | YES |
CVE-2008-0513HIGH Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter | Jan 31, 2008 | 7.8 | 30 | NO | YES |
CVE-2020-22203CRITICAL SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php. | Jun 16, 2021 | 9.8 | 28 | NO | NO |
CVE-2020-22199CRITICAL SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php. | Jun 16, 2021 | 9.8 | 28 | NO | NO |
CVE-2018-14399CRITICAL libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI in the SRC attribute of an IMG element w | Jul 19, 2018 | 9.8 | 28 | NO | NO |
CVE-2020-22201HIGH phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php. | Jun 16, 2021 | 8.8 | 27 | NO | NO |
CVE-2018-14940HIGH PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkcode request. | Aug 5, 2018 | 7.5 | 23 | NO | NO |
CVE-2004-1202MEDIUM Cross-site scripting (XSS) vulnerability in parser.php in phpCMS 1.2.1 and earlier, with non-stealth and debug modes enabled, allows remote attackers to inject arbitrary web script | Jan 10, 2005 | 6.8 | 23 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (18 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
5.6% of CVEs· Bottom 1%
ExploitDB
2 CVEs
11.1% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (18 CVEs).
Media Mentions
Signals from CVEs in this product scope (18 CVEs).
Top CNAs Publishing CVEs For Php Cms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.6.3 | 3 | 5.9 | 0.4% | 0 | 0 |
| 9.6.0 | 1 | 9.8 | 1.5% | 0 | 0 |
| 9.1.13 | 1 | 5.3 | 1.4% | 0 | 0 |
| 9.0 | 1 | 7.5 | 1.3% | 0 | 0 |
| 2008 | 3 | 9.5 | 7.8% | 0 | 1 |
| 2007 | 1 | 9.8 | 1.2% | 0 | 0 |
| 1.2.2 | 1 | 7.8 | 3.5% | 0 | 1 |
| 1.2.1_pl1 | 1 | 5.0 | 1.8% | 0 | 0 |
| 1.2.1_p12 | 2 | 6.3 | 4.9% | 0 | 1 |
| 1.2.1 | 3 | 5.6 | 1.8% | 0 | 0 |
| 1.2.0 | 2 | 5.0 | 1.6% | 0 | 0 |
| 1.2 | 1 | 6.8 | 2.3% | 0 | 0 |
| 1.1.9 | 2 | 5.9 | 1.8% | 0 | 0 |
| 1.0 | 2 | 8.7 | 1.2% | 0 | 0 |