Veille CVE

Mercredi 17 juin 2026

56 CVE

Critique 14 Élevée 36 Moyenne 6 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « php » ✕
  1. CVE-2026-48979 7.5 Élevée

    php-standard-library · php-standard-library/h2

    PHP Standard Library (PSL) is set of APIs covering async, collections, networking, I/O, cryptography, terminal UI, etc. In versions 6.1.0, 6.1.1 and 6.2.0, the Psl\H2\ServerConnection does not validate that the total bytes received in DATA frames match the content-length header declared in the HEADERS frame, allowing request smuggling. This is in violation of RFC 9113 §8.1.1. A malicious client is able to send more DATA bytes than declared, smuggling additional content past application-level size limits and send fewer DATA bytes than declared and close the stream early, causing applications that trust the declared length to behave incorrectly. The vulnerability is only reachable for consumers using Psl\H2\ServerConnection directly to accept untrusted client traffic. Consumers of documented high-level PSL APIs are not affected. This issue has been fixed in versions 6.1.2 and 6.2.1.

  2. CVE-2026-48822 5.8 Moyenne

    Shaarli

    Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversion process used in the Bookmark Description field. An authenticated user can inject a malicious javascript: URI inside a Markdown link. The vulnerability originates in the filterProtocols method within BookmarkMarkdownFormatter.php.This method attempts to sanitize Markdown links by filtering dangerous protocols (such as javascript:) before rendering. It uses the following regular expression: (#]\((.*?)\)#is). This regex is designed to detect inline Markdown links, but it fails to detect Markdown reference-style links because reference-style links are resolved by the Markdown parser after preprocessing. The filterProtocols method never inspects the actual URL used in these references and as a result, an attacker can supply a javascript: URI inside a reference definition. This issue has been fixed in version 0.16.2.

  3. CVE-2026-12529 7.3 Élevée

    SourceCodester CET Automated Grading System with AI Predictive Analytics

    A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. Affected is an unknown function of the file /index.php of the component Student Self-Registration Endpoint. The manipulation leads to improper access controls. Remote exploitation of the attack is possible.

  4. CVE-2026-11407 7.2 Élevée

    Pimcore GmbH Pimcore CMS/DXP

    Pimcore CMS/DXP version 12.3.8 contains a sandbox bypass vulnerability that allows authenticated administrative attackers to execute arbitrary methods on PHP objects by exploiting empty checkMethodAllowed() and checkPropertyAllowed() implementations in the custom Twig SecurityPolicy. Attackers can supply malicious Twig templates through the DataObject ClassDefinition Layout\Text component to perform arbitrary file reads, execute arbitrary database queries, and potentially achieve remote code execution via PHP object gadget chains, with the pimcore_* function wildcard further broadening the bypass to all Pimcore Twig functions.

  5. CVE-2026-54415 8.1 Élevée

    Azuriom CMS

    Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses via crafted HTTP requests to /admin/servers/create and the AzLink API endpoints (/api/azlink/password, /api/azlink/email, /api/azlink/user/{id}).

  6. CVE-2026-54814 8.1 Élevée

    StylemixThemes Motors

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors allows PHP Local File Inclusion. This issue affects Motors: from n/a through 1.4.109.

  7. CVE-2026-49108 9.8 Critique

    park_of_ideas Moderno

    Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

  8. CVE-2026-40757 8.1 Élevée

    Mikado-Themes Château

    Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

  9. CVE-2026-40756 8.1 Élevée

    Mikado-Themes Zoya

    Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.

  10. CVE-2026-40752 8.1 Élevée

    Select-Themes Manufaktur Solutions

    Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

  11. CVE-2026-40738 8.1 Élevée

    Edge-Themes Eldon

    Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

  12. CVE-2026-40733 8.1 Élevée

    Mikado-Themes ShiftUp

    Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

  13. CVE-2026-39576 8.1 Élevée

    Elated-Themes SingleMalt

    Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

  14. CVE-2026-39560 8.1 Élevée

    Select-Themes Hiroshi

    Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

  15. CVE-2026-39556 8.1 Élevée

    Elated-Themes Konsept

    Unauthenticated PHP Object Injection in Konsept <= 1.9 versions.

  16. CVE-2026-39445 8.1 Élevée

    PressLayouts Alukas

    Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

  17. CVE-2026-39442 8.1 Élevée

    PressLayouts PressMart

    Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

  18. CVE-2025-69127 9.8 Critique

    ThemeREX Plumbing

    Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.

  19. CVE-2025-69111 9.8 Critique

    ThemeREX Reisen

    Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

  20. CVE-2026-54806 9.8 Critique

    Melapress WP Activity Log

    Unauthenticated PHP Object Injection in WP Activity Log <= 5.6.3.1 versions.

  21. CVE-2026-54194 9.8 Critique

    ThemeFusion Fusion Builder

    Contributor PHP Object Injection in Fusion Builder <= 3.15.4 versions.

  22. CVE-2026-52706 9.8 Critique

    Jetimpex Inc. JetEngine

    Unauthenticated PHP Object Injection in JetEngine <= 3.8.10 versions.

  23. CVE-2026-49107 9.8 Critique

    Thrive Themes Thrive Apprentice

    Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

  24. CVE-2026-49075 9.8 Critique

    Jetimpex Inc. JetEngine

    Contributor PHP Object Injection in JetEngine <= 3.8.9.1 versions.

  25. CVE-2026-42380 9.8 Critique

    jwsthemes AI Lab

    Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

  26. CVE-2026-40761 8.1 Élevée

    Edge-Themes Valeska

    Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

  27. CVE-2026-40760 8.1 Élevée

    Edge-Themes Behold

    Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

  28. CVE-2026-40759 8.1 Élevée

    Mikado-Themes Esmée

    Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

  29. CVE-2026-40758 8.1 Élevée

    Elated-Themes Léonie

    Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

  30. CVE-2026-40755 8.1 Élevée

    Mikado-Themes TechLink

    Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.

  31. CVE-2026-40754 8.1 Élevée

    Elated-Themes Roisin

    Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

  32. CVE-2026-40753 8.1 Élevée

    Mikado-Themes EasyMeals

    Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

  33. CVE-2026-40751 8.1 Élevée

    Mikado-Themes Ashtanga

    Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.

  34. CVE-2026-40739 8.1 Élevée

    Mikado-Themes LuxeDrive

    Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

  35. CVE-2026-40736 8.1 Élevée

    Edge-Themes Laurits

    Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

  36. CVE-2026-40735 8.1 Élevée

    Edge-Themes Reina

    Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

  37. CVE-2026-40725 9.8 Critique

    Barn2 Media Ltd WooCommerce Product Filters

    Unauthenticated PHP Object Injection in WooCommerce Product Filters < 2.0.6 versions.

  38. CVE-2026-39580 8.1 Élevée

    Select-Themes Micdrop

    Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

  39. CVE-2026-39578 5.5 Moyenne

    Elated-Themes Valiance

    Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.

  40. CVE-2026-39577 5.5 Moyenne

    Elated-Themes Playroom

    Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

  41. CVE-2026-39573 8.1 Élevée

    Select-Themes Mildhill

    Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

  42. CVE-2026-39567 8.1 Élevée

    Select-Themes Santé

    Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

  43. CVE-2026-39557 8.1 Élevée

    Elated-Themes NeoBeat

    Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

  44. CVE-2026-39554 8.1 Élevée

    Elated-Themes Fidalgo

    Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

  45. CVE-2026-39545 8.1 Élevée

    Select-Themes Zermatt

    Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

  46. CVE-2026-39539 8.1 Élevée

    Edge-Themes Alloggio - Hotel Booking

    Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

  47. CVE-2026-39529 9.8 Critique

    ThemeREX Group Elementra

    Unauthenticated PHP Object Injection in Elementra <= 1.0.9 versions.

  48. CVE-2026-39446 8.1 Élevée

    PressLayouts Kapee

    Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

  49. CVE-2026-39443 8.1 Élevée

    PressLayouts EmallShop

    Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

  50. CVE-2026-27870 4.8 Moyenne

    Teldat Regesta Smart HD-PLC - TLDPH16D2

    An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action IS required) who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting (XSS)  payload into the 'Hostname' field of the configuration file resulting in a XSS in the path /upgrade/query.php?cmd=p+3%3Bversion. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.

  51. CVE-2026-27868 6.9 Moyenne

    Teldat Regesta Smart HD-PLC - TLDPH16D2

    An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration action is required) who has the vulnerable software could obtain privilege information by using the command Version via the path: /upgrade/query.php?cmd=p+3&3Bversion resulting in a information disclosure. This issue affects Regesta Smart HD-PLC - TLDPH16D2: 11.02.05.10.02.

  52. CVE-2026-27429 9.8 Critique

    BoldThemes Nifty

    Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

  53. CVE-2026-12165 8.8 Élevée

    contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe

    The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 30.0.2 via the `RegistryUserRole` parameter. This is due to the plugin's admin menu being registered at the `edit_posts` capability level — granting Contributor-level users access to the plugin's admin pages and a valid `cg_admin` nonce — while the option-saving handler in `change-options-and-sizes.php` performs no `current_user_can()` capability check beyond `check_admin_referer('cg_admin')`, and the `RegistryUserRole` value is processed only through `sanitize_text_field()` and `htmlentities()` without restriction to an allowlist of permitted role names. This makes it possible for authenticated attackers, with author-level access and above, to overwrite the plugin's stored `RegistryUserRole` option with `administrator`, which the `cg_create_wp_user_from_google_user` function then reads back from the `contest_gal1ery_registry_and_login_options` database table without any allowlist validation and passes directly to `wp_update_user()`, effectively promoting a newly registered Google sign-in account to Administrator.

  54. CVE-2026-12115 6.6 Moyenne

    wpcalc Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress

    The Counter Box – Add Countdowns, Timers & Dynamic Counters to WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.13 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Deserialization is triggered automatically upon the post-import redirect that renders the list table, and again when any item is opened for editing, requiring no additional navigation beyond the import action itself.

  55. CVE-2025-69122 9.8 Critique

    ThemeREX SeaFood Company

    Unauthenticated PHP Object Injection in SeaFood Company <= 1.4 versions.

  56. CVE-2025-69108 9.8 Critique

    ThemeREX Hot Coffee

    Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.