Veille CVE

Jeudi 30 juillet 2026

19 CVE sur 35

Critique 19 Élevée 13 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « php » ✕
  1. CVE-2026-35847 9.8 Critique

    An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file

  2. CVE-2025-69947 9.8 Critique

    SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.

  3. CVE-2025-69941 9.8 Critique

    SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.

  4. CVE-2025-69938 9.8 Critique

    CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.

  5. CVE-2025-69937 9.8 Critique

    CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.

  6. CVE-2025-69936 9.8 Critique

    CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.

  7. CVE-2025-69935 9.8 Critique

    CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.

  8. CVE-2025-69934 9.8 Critique

    CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.

  9. CVE-2025-69933 9.8 Critique

    CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.

  10. CVE-2025-69931 9.8 Critique

    CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.

  11. CVE-2025-69930 9.8 Critique

    CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.

  12. CVE-2025-65336 9.8 Critique

    Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.

  13. CVE-2026-17544 9.8 Critique

    PHP Group PHP · Php php

    Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

  14. CVE-2026-17543 9.8 Critique

    PHP Group PHP · Php php

    Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

  15. CVE-2026-14602 9.0 Critique

    Unknown Remote API

    The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attackers to inject arbitrary PHP objects, which can lead to remote code execution when a suitable gadget chain is present through another installed Remote API WordPress plugin through 0.2.

  16. CVE-2025-69943 9.8 Critique

    kishan0725 Hospital Management System 4.0 is vulnerale to SQL Injection in get_doctor.php via the parameters doctor and specilizationid.

  17. CVE-2025-69942 9.8 Critique

    kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1.

  18. CVE-2025-67404 9.8 Critique

    Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class.

  19. CVE-2025-67403 9.8 Critique

    Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name.