Vulnerabilities
Summary — last 7 days
New vulnerabilities4,506▼ 894 vs. last week
Critical / high1,763▼ 1,325 vs. last week
New active exploitation (KEV)6▼ 3 vs. last week
Unscored (no CVSS)759▲ 666 vs. last week
More filters
6 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Modified | Critical (9.8) | 1.3% | — | Phpcollab | 10/26/2017 | 6/17/2026 | SQL injection vulnerability in phpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter to newsdesk/newsdesk.php. | |
| Modified | High (8.8) | 96% | Exploit | Phpcollab | 10/3/2017 | 6/17/2026 | Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in logos_clients/. | |
| Modified | Critical (9.8) | 3.0% | Exploit | Phpcollab | 10/3/2017 | 6/17/2026 | SQL injection vulnerability in PhpCollab 2.5.1 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) project or id parameters to topics/deletetopics.php; the (2) id parameter to bookmarks/deletebookmarks.php; or the (3) id parameter to calendar/deletecalendar.php. | |
| Modified | Medium (5) | 1.2% | — | Php-collab Phpcollab | 9/24/2011 | 6/16/2026 | phpCollab 2.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by topics/noti_newtopic.php and certain other files. | |
| Modified | High (10) | 3.0% | — | Phpcollab | 12/23/2008 | 6/16/2026 | general/login.php in phpCollab 2.5 rc3 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified input related to the SSL_CLIENT_CERT environment variable. NOTE: in some environments, SSL_CLIENT_CERT always has a base64-encoded string value, which may impose constraints… | |
| Modified | High (7.5) | 6.3% | Exploit | NetofficePhpcollab | 3/30/2006 | 6/16/2026 | SQL injection vulnerability in general/sendpassword.php in (1) PHPCollab 2.4 and 2.5.rc3, and (2) NetOffice 2.5.3-pl1 and 2.6.0b2 allows remote attackers to execute arbitrary SQL commands via the loginForm parameter in the "forgotten password" option. |