CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 27/07/2026 |
| CVE-2026-48030 | 严重9.9 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely by | 27/07/2026 |
| GHSA-f25v-x6vr-962g | 严重10.0 | Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password | 24/07/2026 |
| GHSA-g3hq-hphg-8fhh | 高危8.8 | Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes | 24/07/2026 |