Phpcms is a modestly represented content-management system whose vulnerability footprint centers on a narrowly scoped product line including the core Phpcms platform and legacy variants, alongside discrete modules such as its guestbook feature. Vulnerabilities affecting the vendor skew toward serious outcomes and frequently acquire public exploit code, with recurring exposure through classic web-application weakness classes including cross-site scripting, SQL injection, code injection, and path traversal that are characteristic of server-side template and user-input processing logic. Defenders should treat Phpcms installations as requiring timely patch management and input-boundary hardening; current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpcms over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-19127CRITICAL A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary co | Nov 9, 2018 | 9.8 | 51 | NO | YES |
CVE-2011-0645HIGH SQL injection vulnerability in data.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the where_time parameter in a get action. | Jan 25, 2011 | 7.5 | 32 | NO | YES |
CVE-2011-0644HIGH SQL injection vulnerability in include/admin/model_field.class.php in PHPCMS 2008 V2 allows remote attackers to execute arbitrary SQL commands via the modelid parameter to flash_up | Jan 25, 2011 | 7.5 | 32 | NO | YES |
CVE-2022-26613CRITICAL PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability via the category parameter in categorymenu.php. | Apr 6, 2022 | 9.8 | 31 | NO | NO |
CVE-2006-3019HIGH Multiple PHP remote file inclusion vulnerabilities in phpCMS 1.2.1pl2 allow remote attackers to execute arbitrary PHP code via a URL in the PHPCMS_INCLUDEPATH parameter to files in | Jun 15, 2006 | 7.5 | 31 | NO | YES |
CVE-2008-0513HIGH Directory traversal vulnerability in parser/include/class.cache_phpcms.php in phpCMS 1.2.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter | Jan 31, 2008 | 7.8 | 30 | NO | YES |
CVE-2020-22203CRITICAL SQL Injection in phpCMS 2008 sp4 via the genre parameter to yp/job.php. | Jun 16, 2021 | 9.8 | 28 | NO | NO |
CVE-2020-22199CRITICAL SQL Injection vulnerability in phpCMS 2007 SP6 build 0805 via the digg_mod parameter to digg_add.php. | Jun 16, 2021 | 9.8 | 28 | NO | NO |
CVE-2018-14399CRITICAL libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php#.jpg URI in the SRC attribute of an IMG element w | Jul 19, 2018 | 9.8 | 28 | NO | NO |
CVE-2020-22201HIGH phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php. | Jun 16, 2021 | 8.8 | 27 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpcms.
Media articles that mention a CVE ID that affects a product developed by Phpcms — matched by CVE ID, not by vendor name.