Threat database

CVE-2026-54713 is a low-severity vulnerability in CakePHP Queue versions from 0.1.11 up to but not including 2.3.1. The issue arises because the QueueManager::getUniqueId() method generates job identifiers by sorting parameter values but drops associative-array keys, causing semantically different job parameters to produce identical identifiers. This can lead to legitimate jobs being incorrectly dropped as duplicates when the shouldBeUnique feature is enabled. The vulnerability is fixed in version 2.3.1.

CVE-2026-54614 is a medium severity vulnerability in the CakePHP DebugKit component affecting versions prior to 4.10.3 and 5.2.4. The vulnerability involves unsafe reflection in the MailPreview feature, where an attacker with access to DebugKit in debug mode and from a local or allowlisted hostname can cause arbitrary constructor execution by manipulating the previewName parameter. This can lead to limited disclosure of application information. The issue is fixed in DebugKit versions 4.10.3 and 5.2.4.

CakePHP Authentication versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 contain a vulnerability that allows authentication bypass and potential CPU or memory exhaustion when using the CookieAuthenticator with unencrypted, forgeable legacy tokens. This issue is resolved in versions 2.11.2, 3.3.7, and 4.2.1.

FilamentPHP filament versions prior to 4.12.0 and 5.7.0 contain an improper authentication vulnerability that allows bypassing app-based multi-factor authentication when recovery codes are enabled. Email-based multi-factor authentication is not affected. The issue is fixed in versions 4.12.0 and 5.7.0.

CVE-2026-75089 is a medium severity SQL injection vulnerability in PHPGurukul Complaint Management System version 1.0. The flaw exists in the user/check_availability.php file where manipulation of the email argument allows remote attackers to inject SQL commands. Public exploit code is available, enabling potential attacks. No patch or remediation information is provided.

phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central verifyCsrfGetToken check uses enforce=false and is bypassed when the token parameter is absent). A remote attacker can trick a logged-in super-administrator into loading a crafted URL (e.g., embedded as an image in an email) to delete any non-self administrator account.

phpList versions before 3.7.0-RC5 have a Cross-Site Request Forgery (CSRF) vulnerability in the bounce rule deletion endpoints. The application fails to enforce CSRF token validation properly when deleting bounce rules via a GET request, allowing an attacker to trick an authenticated administrator into deleting arbitrary bounce rules without a valid CSRF token.

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. From 5.0.0 until 5.8.4, Smarty's stream: resource-name handling does not adequately restrict which PHP stream wrappers and filter chains can be referenced from a template, allowing a php://filter-wrapped resource name to be used to read the contents of arbitrary local files accessible to the PHP process. An attacker able to author or influence a template's resource reference could exploit this to disclose sensitive file contents outside the intended template/config scope. This issue is fixed in version 5.8.4.

Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7.

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 0.6.0 until 2.9.0, specially crafted Markdown lines can cause the parser to have quadratic time complexity when converting, because several parsing paths repeatedly rescan growing portions of a line to translate between character positions and byte positions, and the Autolink extension can also copy and validate the remaining line at every URL-like prefix, allowing an attacker who can submit Markdown for conversion to consume disproportionate CPU time with a comparatively small request. This issue is fixed in 2.9.0.

league/commonmark is a PHP library for parsing and rendering CommonMark Markdown. From 1.5.0 until 2.9.0, the AttributesExtension's href and src unsafe-link filter can be bypassed by embedding control bytes, such as a tab, carriage return, line feed, or leading C0 control character, in a javascript: URL that browsers discard before parsing the scheme, causing the browser to still execute the script even when the unsafe-link filter is enabled. This issue is fixed in 2.9.0.

PHP_CodeSniffer versions prior to 3.13.6 and 4.0.2 contain a command injection vulnerability in the code generating Gitblame, Hgblame, and Svnblame report formats. This vulnerability allows attacker-controlled shell commands to be executed if a file name contains shell metacharacters and is processed by these blame report formats. Users running default or other non-blame reports, or on platforms that disallow such filenames, are not affected. The issue is fixed in versions 3.13.6 and 4.0.2.

A reflected cross-site scripting (XSS) vulnerability exists in PHP Jabbers PHP Poll Script versions prior to 4.1. This flaw allows an attacker to craft a malicious URL that executes arbitrary JavaScript in the victim's browser when opened. The vulnerability is fixed in version 4.1.

A SQL injection vulnerability exists in PHP Jabbers PHP Poll Script allowing an authenticated attacker to exploit improper input neutralization in the pjAdminPolls.controller.php endpoint. This vulnerability enables high-impact SQL injection attacks. The issue was fixed in version 4.1. The vulnerability has a high CVSS 4.0 score of 8.6.

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple PHP Jabbers Appointment Scheduler scripts due to missing CSRF tokens or appropriate SameSite cookie attributes. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users, including creating new administrative accounts. The vulnerability has a medium severity score of 6.9 and has been assigned CVE-2025-67651. The issue is known and published but no specific affected versions or patches have been provided in the available data.

CVE-2025-67650 is an authenticated SQL injection vulnerability in multiple PHP Jabbers scripts, specifically in the Appointment Scheduler product. The flaw arises from improper neutralization of input provided by authenticated users in parameters related to sorting functions, enabling SQL injection attacks. This vulnerability has a high severity score of 8.6 and was published in July 2026. The issue has been fixed in certain versions, though those specific versions are not listed in the provided data.

A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1.