#PHP
All CosmicBytez Labs articles tagged #PHP, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-108799: SQL Injection in XCMS Password Recovery Endpoint
High-severity SQLi (CVSS 7.3) in jackq XCMS's password recovery mail endpoint lets remote, unauthenticated attackers inject SQL via the email field.
- Security
CVE-2026-105182: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System via Title Parameter
SourceCodester Online Reviewer Management System 1.0 lets remote, unauthenticated attackers inject SQL via the Title parameter in btn_functions.php.
- Security
CVE-2026-102909: SQL Injection in SourceCodester Online Reviewer Management System via access_code
CVE-2026-102909: SourceCodester Online Reviewer Management System 1.0 allows remote SQL injection via the access_code parameter in btn_functions.php.
- Security
CVE-2026-102908: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System
SourceCodester Online Reviewer Management System v1.0's questions-view.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-100314: SQL Injection in CloudClassroom-PHP-Project Student Details Update
CloudClassroom-PHP-Project is vulnerable to remote SQL injection via the eno parameter in updatedetailsfromstudent.php; the vendor has not responded.
- Security
CVE-2026-100315: SQL Injection in CloudClassroom-PHP-Project Faculty Details Lookup
CloudClassroom-PHP-Project is vulnerable to remote SQL injection via the myfid parameter in mydetailsfaculty.php; a public PoC exploit exists.
- Security
CloudClassroom-PHP-Project viewresult.php SQL Injection (CVE-2026-100739)
An unpatched SQL injection in CloudClassroom-PHP-Project's viewresult.php lets remote attackers manipulate the seno parameter to steal data.
- Security
CVE-2026-93973: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System (Subject Module)
Online Reviewer Management System v1.0's subject btn_functions.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-93974: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System (Databank Module)
Online Reviewer Management System v1.0's databank btn_functions.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-93997: Unauthenticated SQL Injection in SourceCodester Drug Recommendation System
Drug Recommendation System v1.0's edit_symptom.php lets remote, unauthenticated attackers inject SQL via the ID parameter.
- Security
CVE-2026-93959: Unauthenticated SQL Injection in SourceCodester Online Reviewer Management System
Online Reviewer Management System v1.0's btn_functions.php lets remote, unauthenticated attackers inject SQL via the Course parameter. PoC public.
- Security
CVE-2026-77929: Authenticated File Upload Leads to Remote Code Execution in ClipBucket v5
CVSS 8.8 flaw in ClipBucket v5 lets authenticated users upload PHP files disguised as images to the photo endpoint, achieving remote code execution.
- Security
CVE-2026-90854: SQL Injection in SourceCodester Online Food Ordering System
SourceCodester's Online Food Ordering System 1.0 is vulnerable to remote SQL injection via the ID parameter in category-foods.php; a public exploit exists.
- Security
CVE-2026-90566: Privilege Escalation via Unvalidated usertype in inventory-management-system
A CVSS 7.3 flaw in Rizwan17's inventory-management-system lets attackers set a privileged usertype during registration, escalating to admin access.
- News
"Poisoned Refresh" Rootkit Injects Fileless PHP Web Shells on Breached F5 BIG-IP Devices
Sophos found a stealthy Linux rootkit hooking PHP on F5 BIG-IP APM servers to inject memory-only web shells, leaving disk files untouched.
- Security
CVE-2026-82610: SQL Injection in itsourcecode Online Medicine Delivery System
An unauthenticated SQL injection in the employee login of itsourcecode's Online Medicine Delivery System 1.0 has a public exploit available.
- Security
CVE-2026-78143: SQL Injection in Barangay Resident Profiling Management System
High-severity SQL injection in Barangay Resident Profiling System 1.0 lets remote attackers extract personal data via the residents.php Search parameter.
- Security
CVE-2026-0551: PHP Object Injection in PPWP – Password Protect Pages WordPress Plugin
PPWP WordPress plugin up to 1.9.18 allows contributor-level PHP object injection via deserialization, enabling RCE on affected sites.
- News
Forminator WordPress Plugin Flaw Enables Unauthenticated RCE via PHP Upload
CVE-2026-15748 (CVSS 9.8) in Forminator Forms allows unauthenticated PHP webshell uploads for full RCE on 600,000+ WordPress sites. Patch to 1.56.2 now.
- Security
WordPress ARForms Plugin Critical PHP Object Injection — CVE-2024-13784
A critical unauthenticated PHP object injection flaw in the ARForms WordPress plugin (CVSS 9.8) allows arbitrary code execution via deserialization.
- Security
CVE-2026-72819: Grav CMS RCE via ZIP Upload Bypass in Flex Objects Plugin
Grav CMS before 2.0.13 allows authenticated users to achieve RCE by bypassing filename validation with PHP-laden ZIP files.
- Security
CVE-2026-73683: Laravel Socialite Facebook OIDC Authentication Bypass
Laravel Socialite's Facebook provider is vulnerable to OIDC id_token replay attacks due to missing nonce validation in getUserByOIDCToken().
- Security
CVE-2026-39932: Critical RCE in OpenEMR via PHP Payload Injection
OpenEMR through 8.2.0 contains a critical remote code execution vulnerability allowing authenticated administrators to execute arbitrary OS commands by...
- Security
CVE-2025-65336: Critical SQL Injection in Fruits Bazar PHP Ecommerce
CVSS 9.8 SQL injection vulnerability in the show_price_by_pdtId.php endpoint of the Fruits Bazar PHP/MySQLi ecommerce project allows unauthenticated...
- Security
CVE-2025-69941: Critical SQL Injection in Tailor Management System — Measurement Endpoint
CVSS 9.8 SQL injection in SourceCodester Tailor Management System 1.0 allows unauthenticated attackers to read, modify, or delete all database records...
- Security
CVE-2025-69947: Critical SQL Injection in Tailor Management System — Customer Edit Endpoint
CVSS 9.8 SQL injection in SourceCodester Tailor Management System 1.0 exposes full customer records through an unsanitized id parameter in...
- News
vBulletin Fixes Critical Pre-Auth RCE Flaw with Public Exploit
vBulletin has patched a critical unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary PHP code through template...
- Security
CVE-2026-65008: Grav CMS RCE via Uncontrolled Callable in Blueprint::dynamicData()
Grav CMS 2.0.4 contains a critical remote code execution vulnerability where Blueprint::dynamicData() passes attacker-controlled callable strings directly...
- Security
CVE-2026-48062: CodeIgniter File Upload Validation Bypass (CVSS 9.8)
CodeIgniter versions prior to 4.7.3 contain a critical file upload validation flaw where the ext_in rule checks MIME-derived extensions instead of...
- Security
ChurchCRM Plugin RCE via Malicious ZIP Upload — CVE-2026-58409
A critical authenticated RCE vulnerability in ChurchCRM allows administrators to achieve remote code execution by uploading a malicious plugin ZIP...
- Security
CVE-2026-15488: Unrestricted File Upload in shiroiAdmin Enables Remote Code Execution
A high-severity unrestricted file upload vulnerability in shiroiAdmin versions 1.1 and 1.3 allows unauthenticated remote attackers to upload PHP webshells...
- Security
CVE-2026-15489: SQL Injection in TOKO-ONLINE-ROTI Login Endpoint
A high-severity SQL injection vulnerability in the TOKO-ONLINE-ROTI bakery management system allows remote attackers to manipulate the login.php Username...
- Security
CVE-2026-15490: SQL Injection in TOKO-ONLINE-ROTI Product Add Endpoint
A high-severity SQL injection vulnerability in the TOKO-ONLINE-ROTI PHP bakery system allows remote attackers to manipulate the kode_produk and kd_cs...
- Security
CVE-2024-6228: WordPress WANotifier Plugin Local File Inclusion
A local file inclusion vulnerability in the WANotifier WordPress plugin (before v2.6) allows any authenticated subscriber-level user to include and...
- Security
CVE-2026-14635: Unrestricted File Upload RCE in CodeIgniter Ecommerce Bootstrap
A high-severity unrestricted file upload vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap allows authenticated vendor users to upload...
- Security
CVE-2026-14637: PHP Deserialization RCE in CodeIgniter Ecommerce Bootstrap Shopping Cart
A high-severity PHP deserialization vulnerability in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap allows attackers to inject malicious serialized...
- Security
CVE-2026-14641: Remote SQL Injection in SourceCodester Class and Exam Timetabling System
A high-severity SQL injection vulnerability in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to dump the...
- Security
CVE-2026-14642: Remote SQL Injection in SourceCodester Timetabling System edit_class2.php
A high-severity SQL injection vulnerability in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to fully...
- Security
CVE-2026-14652: SQL Injection in SourceCodester Shopping Cart Admin Login
A high-severity SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0 allows remote attackers to manipulate the admin...
- Security
CVE-2026-14653: SQL Injection in Shopping Cart Men's Product Delete Endpoint
A high-severity SQL injection flaw in SourceCodester Simple and Nice Shopping Cart Script 1.0 exposes the men's product delete query to remote...
- Security
CVE-2026-14654: SQL Injection in Shopping Cart Girls Product Delete Endpoint
A high-severity SQL injection vulnerability in SourceCodester Simple and Nice Shopping Cart Script 1.0 allows remote attackers to exploit the girls...
- Security
CVE-2026-14688: SQL Injection in itsourcecode Hotel Management Admin Login
A high-severity SQL injection vulnerability in itsourcecode Online Hotel Management System 1.0 allows remote attackers to exploit the admin login page via...
- Security
SQL Injection in Multi-Vendor Online Grocery Management System (CVE-2026-14695)
A high-severity SQL injection vulnerability in SourceCodester's Multi-Vendor Online Grocery Management System 1.0 allows remote attackers to manipulate...
- Security
SQL Injection in Pizzafy E-Commerce System Exposes Order Data (CVE-2026-14713)
A remotely exploitable SQL injection flaw in SourceCodester Pizzafy E-Commerce System 1.0 allows attackers to manipulate the confirm_order endpoint via an...
- Security
Privilege Escalation via Role Manipulation in Online Exam LMS (CVE-2026-14719)
A high-severity improper privilege management flaw in SourceCodester's Online Examination and Learning Management System 1.0 allows remote attackers to...
- Security
CVE-2026-14622: Missing Authentication in Restaurant Website PHP/MySQL AJAX Endpoint
A missing authentication vulnerability (CVSS 7.3) in the jairiidriss/restaurant-website-php-mysql project exposes the /admin/ajax_files endpoint to...
- News
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution
CISA has added a maximum-severity vulnerability in the Joomla Content Editor (JCE) plugin to its Known Exploited Vulnerabilities catalog, warning that the...
- Security
CVE-2026-12204: ShopXO Scheduled Task Authorization Bypass
A CVSS 7.3 authorization bypass vulnerability in ShopXO up to 6.7.1 allows unauthenticated access to scheduled task endpoints in the Crontab controller,...
- Security
CVE-2026-10236: Improper Authorization in SourceCodester Water Billing Management System
A remotely exploitable improper authorization vulnerability in the SourceCodester Water Billing Management System 1.0 allows unauthenticated attackers to…
- Security
CVE-2026-10167: School Student Management System Cookie Auth Bypass
A high-severity authentication bypass vulnerability in OUSL-GROUP BrinaryBrains School Student Management System allows manipulation of the sign_auth_cookie…
- Security
CVE-2026-10178: SQL Injection in Online Music Site 1.0 Admin Panel
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Online Music Site 1.0, affecting the Administrator PHP AdminEditAlbum…
- Security
CVE-2018-25391: HaPe PKH 1.1 Unauthenticated Record Deletion via Missing Authorization
HaPe PKH 1.1, a PHP-based web application, fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to...
- Security
CVE-2026-10110: SQL Injection in Student Details Management System 1.0
A remotely exploitable SQL injection vulnerability in code-projects Student Details Management System 1.0 allows attackers to manipulate database queries...
- Security
CVE-2026-45247 — Mirasvit Magento 2 Cache Warmer PHP Object Injection RCE
CVSS 9.8 PHP object injection in Mirasvit Full Page Cache Warmer for Magento 2 lets unauthenticated attackers achieve RCE — patch to 1.11.12 now.
- Security
CVE-2018-25362: Twitter-Clone SQL Injection via follow.php
Twitter-Clone 1 contains a high-severity SQL injection vulnerability in follow.php that allows attackers to extract sensitive database information through.
- News
Laravel Lang Packages Hijacked to Deploy
A supply chain attack targeting Laravel Lang localization packages has exposed developers to credential-stealing malware after attackers abused GitHub...
- News
Laravel-Lang PHP Packages Compromised to Deliver
Multiple PHP packages belonging to the Laravel-Lang organization have been poisoned in a software supply chain attack, delivering a cross-platform...
- News
Packagist Supply Chain Attack Infects 8 Packages Using
A coordinated supply chain attack campaign has infected eight Packagist Composer packages with malicious code that downloads and executes a Linux binary...
- Security
CVE-2026-8785: SQL Injection in Hospital Management System
A high-severity SQL injection vulnerability (CVE-2026-8785, CVSS 7.3) has been disclosed in projectworlds Hospital Management System in PHP 1.0, allowing...
- Security
CVE-2021-47936: OpenCATS 0.9.4 Unauthenticated RCE via PHP
OpenCATS 0.9.4 allows unauthenticated attackers to upload malicious PHP files through the careers job application endpoint, achieving remote code...
- Security
CVE-2026-6433: WordPress Plugin SQLi Enables
The Custom css-js-php WordPress plugin through version 2.0.7 fails to sanitize user input before using it in a SQL query, and passes the result to dynamic...
- Security
CVE-2026-42569: phpVMS Critical Unauthenticated Legacy
A critical vulnerability (CVSS 9.4) in phpVMS before version 7.0.6 allows unauthenticated attackers to access a legacy import feature, potentially...
- Security
CVE-2026-7224: SQL Injection in Pizzafy Ecommerce System 1.0
A high-severity SQL injection vulnerability has been discovered in SourceCodester Pizzafy Ecommerce System 1.0, allowing remote attackers to manipulate...
- Security
CVE-2026-7077: SQL Injection in itsourcecode Courier
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Courier Management System 1.0, affecting the edit_parcel.php file...
- Security
Typecho 1.3.0 Pingback SSRF via X-Pingback Manipulation
A CVSS 7.3 server-side request forgery vulnerability in Typecho up to 1.3.0 allows attackers to manipulate the X-Pingback/link argument in Service.php to...
- Security
CVE-2026-41309: OSSN Resource Exhaustion via Crafted Pixel
Open Source Social Network (OSSN) versions prior to 9.0 are vulnerable to resource exhaustion via specially crafted image uploads with extreme pixel...
- Security
CVE-2018-25270: ThinkPHP 5.0.23 Remote Code Execution via Routing Parameter
ThinkPHP 5.0.23 contains a critical unauthenticated remote code execution vulnerability allowing attackers to invoke arbitrary PHP functions via a crafted...
- Security
CVE-2026-39918: Vvveb CMS Unauthenticated PHP Code
Vvveb CMS versions prior to 1.0.8.1 allow unauthenticated attackers to inject arbitrary PHP code through the installation endpoint's unsanitized subdir...
- Security
CVE-2026-6595: SQL Injection in ProjectsAndPrograms School
A medium-severity SQL injection vulnerability has been disclosed in ProjectsAndPrograms School Management System, allowing remote attackers to manipulate...
- Security
CVE-2026-40285: WeGIA SQL Injection via PHP extract()
A high-severity SQL injection vulnerability in WeGIA, a web manager for charitable institutions, allows authenticated attackers to escalate privileges by...
- Security
CVE-2026-6004: SQL Injection in code-projects Simple IT
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Simple IT Discussion Forum 1.0, affecting the /delete-category.php...
- Security
CVE-2026-5554: SQL Injection in Concert Ticket Reservation
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Concert Ticket Reservation System 1.0, affecting the...
- Security
CVE-2026-5555: SQL Injection in Concert Ticket Reservation
An unauthenticated SQL injection vulnerability has been disclosed in code-projects Concert Ticket Reservation System 1.0, affecting the login.php file via...
- Security
CVE-2026-5575: SQL Injection in SourceCodester Record
A remotely exploitable SQL injection vulnerability has been disclosed in SourceCodester/jkev Record Management System 1.0, affecting the Login page's...
- Security
CVE-2026-5551: SQL Injection in itsourcecode Free Hotel
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Free Hotel Reservation System 1.0, affecting the login page's email...
- News
Microsoft Details Cookie-Controlled PHP Web Shells
Microsoft Defender researchers have documented a stealthy PHP web shell technique that uses HTTP cookies as a covert command-and-control channel on Linux...
- Security
CVE-2026-1540: Spam Protect CF7 WordPress Plugin PHP Log RCE
The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows an editor-level attacker to achieve Remote Code Execution by logging a crafted...
- Security
CVE-2026-5017: SQL Injection in code-projects Simple Food
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Simple Food Order System 1.0, affecting the /all-tickets.php file...
- Security
CVE-2026-5018: SQL Injection in code-projects Simple Food
A remotely exploitable SQL injection vulnerability exists in code-projects Simple Food Order System 1.0, where the Name parameter in register-router.php...
- Security
CVE-2026-5019: SQL Injection in code-projects Simple Food
A SQL injection vulnerability has been disclosed in code-projects Simple Food Order System 1.0, where the Status parameter in all-orders.php enables...
- Security
CVE-2026-5033: SQL Injection in code-projects Accounting
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Accounting System 1.0, where the cos_id parameter in...
- Security
CVE-2026-5034: SQL Injection in code-projects Accounting
A remotely exploitable SQL injection vulnerability has been disclosed in code-projects Accounting System 1.0, allowing unauthenticated attackers to...
- Security
CVE-2015-20118: Stored XSS in RealtyScript 4.0.2 Admin
A stored cross-site scripting vulnerability in RealtyScript 4.0.2 allows attackers to inject malicious JavaScript via the location_name parameter in the...
- Security
CVE-2015-20115: RealtyScript 4.0.2 Stored XSS via File
CVE-2015-20115 is a stored cross-site scripting vulnerability in RealtyScript 4.0.2 that allows authenticated attackers to upload malicious script files...
- Security
CVE-2026-3730: SQL Injection in itsourcecode Free Hotel
A remotely exploitable SQL injection vulnerability has been disclosed in itsourcecode Free Hotel Reservation System 1.0, affecting the amenities admin...
- Security
CVE-2026-3734: Improper Authorization in SourceCodester
A remotely exploitable improper authorization vulnerability has been disclosed in SourceCodester Client Database Management System 1.0, allowing...
- Security
CVE-2026-3740: SQL Injection in itsourcecode University
A high-severity SQL injection vulnerability has been disclosed in itsourcecode University Management System 1.0, allowing remote attackers to execute...
- Security
CVE-2026-3746: SQL Injection in SourceCodester Simple
A remotely exploitable SQL injection vulnerability has been disclosed in SourceCodester Simple Responsive Tourism Website 1.0, allowing attackers to...