Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
25 results
Oct 22, 2026PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameterCVE-2022-51023 · Websites & servers · PHPOK · reported by VulnCheckHigh 8.8
PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can send GET requests to /api.php?c=project&f=index with extractvalue payloads in sort to extract database information through error messages. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- PHPOK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c.CVE-2025-15142 · Other software · 9786 · reported by VulDBMedium 5.5
A vulnerability was identified in 9786 phpok3w up to 901d96a06809fb28b17f3a4362c59e70411c933c. Impacted is an unknown function of the file show.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- phpok3w
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.CVE-2024-44867 · Websites & servers · phpok · reported by MITREHigh 7.5
phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.
- Product
- phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2024phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.CVE-2024-38953 · Websites & servers · Phpok · reported by MITREMedium 6.1
phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php.CVE-2023-29881 · Websites & servers · phpok · reported by MITREMedium 6.5
phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php.
- Product
- phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jun 20, 2023SQL injection vulnerability in PHPOK v.5.4.CVE-2020-21486 · Websites & servers · Phpok · reported by MITREHigh 7.5
SQL injection vulnerability in PHPOK v.5.4. allows a remote attacker to obtain sensitive information via the _userlist function in framerwork/phpok_call.php file.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2023An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file.CVE-2023-33601 · Websites & servers · Phpok · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2023A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100.CVE-2023-2888 · Websites & servers · Phpok · reported by VulDBMedium 4.7
A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100. This affects an unknown part of the file /admin.php?c=upload&f=zip&_noCache=0.1683794968. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The identifier VDB-229953 was assigned to this vulnerability.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2023PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.CVE-2022-47129 · Websites & servers · Phpok · reported by MITRECritical 9.8
PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comyuque.com
May 11, 2023File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file upload.CVE-2021-34076 · Websites & servers · Phpok · reported by MITREHigh 8.8
File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file upload.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2022Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php.CVE-2022-40889 · Websites & servers · Phpok · reported by MITRECritical 9.8
Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
May 12, 2022Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function in login_control.php.CVE-2022-29363 · Websites & servers · Phpok · reported by MITRECritical 9.8
Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function in login_control.php. This vulnerability allows attackers to getshell via writing arbitrary files.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.CVE-2020-18440 · Websites & servers · Phpok · reported by MITRECritical 9.8
Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write arbitrary files or get aCVE-2020-18439 · Websites & servers · Phpok · reported by MITRECritical 9.1
An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write arbitrary files or get a shell.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php.CVE-2020-18438 · Websites & servers · Phpok · reported by MITREHigh 7.5
Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2021A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious user execute arbitrarCVE-2020-19199 · Websites & servers · Phpok · reported by MITREHigh 8.8
A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious user execute arbitrary code.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2021PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through aCVE-2020-16629 · Websites & servers · Phpok · reported by MITRECritical 9.8
PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2019An issue was discovered in OKLite v1.2.25.CVE-2019-16132 · Websites & servers · Phpok · reported by MITREMedium 6.5
An issue was discovered in OKLite v1.2.25. framework/admin/tpl_control.php allows remote attackers to delete arbitrary files via a title directory-traversal pathname followed by a crafted substring.
- Product
- Oklite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Sep 8, 2019framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can be written to /data/CVE-2019-16131 · Websites & servers · Phpok · reported by MITREHigh 8.8
framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can be written to /data/cache/.
- Product
- Oklite
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Dec 10, 2018An issue was discovered in PHPok v5.0.055.CVE-2018-20006 · Websites & servers · Phpok · reported by MITREMedium 6.1
An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save (reachable via the index.php?id=book URI).
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 26, 2018An issue was discovered in PHPok 4.9.015.CVE-2018-19562 · Websites & servers · Phpok · reported by MITREHigh 8.8
An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Background > Program Upgrade > Compressed Packet Upgrade" action in which a .php file is inside a ZIP archive.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordiwantacve.cniwantacve.cn
Aug 30, 2018PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.CVE-2018-16142 · Websites & servers · Phpok · reported by MITREMedium 6.1
PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordunothing.github.iounothing.github.io
Jun 15, 2018PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php.CVE-2018-12492 · Websites & servers · Phpok · reported by MITREHigh 7.5
PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 15, 2018PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by uploading a .php fiCVE-2018-12491 · Websites & servers · Phpok · reported by MITRECritical 9.8
PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by uploading a .php file within a .php.zip archive, a similar issue to CVE-2018-8944.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 22, 2018PHPOK 4.8.338 has an arbitrary file upload vulnerability.CVE-2018-8944 · Websites & servers · Phpok · reported by MITRECritical 9.8
PHPOK 4.8.338 has an arbitrary file upload vulnerability.
- Product
- Phpok
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.