Veille CVE

Mercredi 30 septembre 2026

52 CVE

Critique 6 Élevée 32 Moyenne 13 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Php php » ✕
  1. CVE-2023-54403 7.5 Élevée

    Yonyou U8 CRM

    Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attackers to bypass authentication using the DontCheckLogin=1 parameter and read arbitrary files via an unvalidated filePath parameter. Attackers can exploit this flaw to read sensitive files outside the web application directory, including configuration files containing database or service credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

  2. CVE-2026-97291 8.8 Élevée

    Magazine3 Schema & Structured Data for WP & AMP

    Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.

  3. CVE-2026-97256 7.2 Élevée

    Greg – SiteOrigin Page Builder by SiteOrigin

    Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.

  4. CVE-2026-103475 9.1 Critique

    yii2-starter-kit

    yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.

  5. CVE-2026-103474 8.8 Élevée

    yii2-starter-kit

    yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and request them to execute arbitrary code on the server.

  6. CVE-2026-102392 7.2 Élevée

    ThemeHigh Extra Product Options For WooCommerce | Custom Product Addons and Fields

    Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.

  7. CVE-2026-102377 8.8 Élevée

    10Web Photo Gallery by 10Web

    Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.

  8. CVE-2026-100512 9.8 Critique

    Hook & Filter Nested Pages

    Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.

  9. CVE-2026-103232 7.3 Élevée

    AdithyaYelloju Restaurant-Management-System

    A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqli_query of the file admin/table_booking.php. This manipulation of the argument Name causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

  10. CVE-2026-103231 7.3 Élevée

    AdithyaYelloju Restaurant-Management-System

    A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqli_query of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

  11. CVE-2026-103230 7.3 Élevée

    AdithyaYelloju Restaurant-Management-System

    A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the file User/ord.php of the component Order Placement. Executing a manipulation of the argument id/name can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

  12. CVE-2026-103229 7.3 Élevée

    AdithyaYelloju Restaurant-Management-System

    A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

  13. CVE-2026-102427 10.0 Critique

    ordasoft.com OrdaSoft Joomla CCK · Ordasoft joomla cck

    Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.

  14. CVE-2026-103388 6.2 Moyenne

    MISP

    MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source. When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim. Preconditions: - Attacker must hold galaxy editor privileges (local or via sync). - Victim must view the affected cluster and click the malicious link. Impact: - Stored cross-site scripting (XSS) in the victim's browser. - Potential session theft, credential harvesting, or unauthorized actions within the MISP application. Affected: <2.5.48.

  15. CVE-2026-97248 9.8 Critique

    Booking Activities Team Booking Activities

    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.

  16. CVE-2026-96833 7.2 Élevée

    Themefic Ultimate Addons for Contact Form 7

    Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.

  17. CVE-2026-96832 7.2 Élevée

    keywordrush Content Egg

    Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.

  18. CVE-2026-96831 8.8 Élevée

    themifyme Themify Builder

    Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.

  19. CVE-2026-96344 7.2 Élevée

    impleCode eCommerce Product Catalog

    Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.

  20. CVE-2026-96343 7.2 Élevée

    weDevs WP ERP

    Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.

  21. CVE-2026-95531 8.8 Élevée

    QuantumCloud Conversational Forms for ChatBot

    Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.

  22. CVE-2026-94683 8.8 Élevée

    Justin Nealey DesignSetGo

    Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.

  23. CVE-2026-94678 8.8 Élevée

    Mat Lipe Go Live Update Urls

    Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.

  24. CVE-2026-94677 7.2 Élevée

    Nexcess Kadence WooCommerce Email Designer

    Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.

  25. CVE-2026-94122 7.2 Élevée

    A WP Life Responsive Slider Gallery

    Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.

  26. CVE-2026-94121 8.8 Élevée

    10Web Booster – Website speed optimization, Cache & Page Speed optimizer

    Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.

  27. CVE-2026-94076 8.8 Élevée

    SEO Squirrly SEO Plugin by Squirrly SEO

    Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

  28. CVE-2026-93771 7.2 Élevée

    WPFactory Cost of Goods for WooCommerce

    Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

  29. CVE-2026-93651 7.2 Élevée

    Dotstore Minimum and Maximum Quantity for WooCommerce

    Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

  30. CVE-2026-93624 7.2 Élevée

    codepeople Music Player for WooCommerce

    Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

  31. CVE-2026-103117 4.7 Moyenne

    OS4ED openSIS-Classic

    A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

  32. CVE-2026-103116 6.3 Moyenne

    OS4ED openSIS-Classic

    A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

  33. CVE-2026-103115 6.3 Moyenne

    OS4ED openSIS-Classic

    A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

  34. CVE-2026-103114 6.3 Moyenne

    OS4ED openSIS-Classic

    A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of the argument Tables leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

  35. CVE-2026-103113 4.7 Moyenne

    OS4ED openSIS-Classic

    A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/students/Student.php of the component General Information Tab. Executing a manipulation of the argument students can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

  36. CVE-2026-97150 8.6 Élevée

    baserCMS Users Community BcAddonMigrator

    When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

  37. CVE-2026-89294 7.5 Élevée

    croixhaug Simply Schedule Appointments

    The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa_locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Notably, exploitation does not require authentication in practice, as the locale filter is installed unconditionally on every request during plugins_loaded and the callback performs no nonce or capability check before returning the raw GET parameter value.

  38. CVE-2026-91051 6.6 Moyenne

    Unknown EWWW Image Optimizer

    The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .

  39. CVE-2026-75873 9.8 Critique

    Unknown Zella Theme

    The Zella Theme WordPress theme before 2.6.3 does not perform any capability or nonce check on one of its font upload actions, which is available to unauthenticated users, allowing them to upload arbitrary files, including PHP ones, and achieve remote code execution.

  40. CVE-2026-75823 7.4 Élevée

    Unknown User Frontend

    The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained this way.

  41. CVE-2026-102913 7.3 Élevée

    SourceCodester Car Driving School Management System

    A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_enrollment. The manipulation results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

  42. CVE-2026-102910 7.3 Élevée

    SourceCodester Online Reviewer Management System

    A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer_0/admins/assessments/examproper/exam-delete.php. The manipulation of the argument test_id results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

  43. CVE-2026-102909 7.3 Élevée

    SourceCodester Online Reviewer Management System

    A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.

  44. CVE-2026-102908 7.3 Élevée

    SourceCodester Online Reviewer Management System

    A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

  45. CVE-2026-102847 4.3 Moyenne

    gedelumbung HospitalManagement

    A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function kirim of the file application/modules/web/controllers/buku_tamu.php of the component Guest Book. This manipulation of the argument nama/email/pesan causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been published and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

  46. CVE-2026-102846 4.7 Moyenne

    gedelumbung HospitalManagement

    A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

  47. CVE-2026-102845 5.3 Moyenne

    gedelumbung HospitalManagement

    A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function error_reporting of the file index.php of the component HTTP Response. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

  48. CVE-2026-102844 2.7 Faible

    gedelumbung HospitalManagement

    A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan_data_pasien.php. Executing a manipulation of the argument id_param can lead to authorization bypass. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

  49. CVE-2026-102843 4.7 Moyenne

    gedelumbung HospitalManagement

    A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function hapus of the file application/modules/admin/controllers/data_galeri.php of the component Endpoint. Performing a manipulation of the argument gbr results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

  50. CVE-2026-102842 6.3 Moyenne

    gedelumbung HospitalManagement

    A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_model.php::cekUserLogin of the file application/models/app_user_login_model.php of the component KCFinder File Manager. Such manipulation of the argument ADMIN_RS_KCFINDER leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

  51. CVE-2026-70356 9.1 Critique

    Toptech Systems TMS7 · Toptech Systems TopHAT

    The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.

  52. CVE-2026-102771 4.7 Moyenne

    Naichen ThinkCMF

    A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.