CVE-2015-5243

phpWhois arbitrary code execution via a crafted whois record

9.8 CriticalFix available

phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.19%Down 0.5 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

Record: CVE-2015-5243
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

Record: CVE-2015-5243
Updated: 2026-11-02

EUVDEUVD-2022-3545 No score

phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

Record: EUVD-2022-3545
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c95f-27gx-6vq9 9.8

phpWhois arbitrary code execution via a crafted whois record

phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

Record: GHSA-c95f-27gx-6vq9
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

OSVGHSA-c95f-27gx-6vq9 9.8

phpWhois arbitrary code execution via a crafted whois record

phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

Record: GHSA-c95f-27gx-6vq9
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

Affected products

phpwhois project phpwhois

Affected packages

Affected packages
Package	Affected	Fixed
`jsmitty12/phpwhois` Packagist	before 5.1.0	5.1.0
`phpwhois/phpwhois` Packagist	through 4.2.5	None known
`brightlocal/phpwhois` Packagist	through 4.2.5	None known
`david-garcia/phpwhois` Packagist	through 4.3.1	None known
`ivankristianto/phpwhois` Packagist	through 4.3.0	None known
`kazist/phpwhois` Packagist	through 4.2.6	None known
`serluck/phpwhois` Packagist	through 4.2.6	None known
`simple-updates/phpwhois` Packagist	through 1.0.0	None known
`truckersmp/phpwhois` Packagist	through 4.3.1	None known
`jsmitty12/phpwhois` Packagist	before 5.1.0, plus listed versions 4.2.34.2.4v4.2.5v5.0v5.0.1v5.0.2	5.1.0

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`phpwhois/phpwhois` Packagist	through 4.2.5, plus listed versions 4.2.34.2.4v4.2.5	None known
`brightlocal/phpwhois` Packagist	through 4.2.5, plus listed versions 4.2.34.2.4v4.2.5	None known
`david-garcia/phpwhois` Packagist	through 4.3.1, plus listed versions 4.2.34.2.44.3.0v4.2.5	None known
`ivankristianto/phpwhois` Packagist	through 4.3.0, plus listed versions 4.2.34.2.4v4.2.5v4.2.6v4.3.0	None known
`kazist/phpwhois` Packagist	through 4.2.6, plus listed versions 4.2.34.2.4v4.2.5v4.2.6	None known
`serluck/phpwhois` Packagist	through 4.2.6, plus listed versions 4.2.34.2.4v4.2.5v4.2.6	None known
`truckersmp/phpwhois` Packagist	through 4.3.1, plus listed versions 4.2.34.2.4v4.2.5v4.3.0v4.3.1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5243 is a critical vulnerability (CVSS 9.8) in Phpwhois Project Phpwhois, published August 20, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.19%, the 93rd percentile. Fixed in jsmitty12/phpwhois 5.1.0.

References

Show 10 moreShow less