Skip to content

Php vulnerabilities

Products

Newest

php** DISPUTED ** PHP treats unknown methods such as "PoSt" as a GET request, which could allow...CVE-2003-0249Disputed7.5 HighDecember 31, 2003
phpThe php_check_safe_mode_include_dir function in fopen_wrappers.c of PHP 4.3.x returns a success...CVE-2003-0863Public exploit7.5 HighOctober 15, 2003
phpInteger overflows in (1) base64_encode and (2) the GD library for PHP before 4.3.3 have unknown...CVE-2003-086110.0 HighOctober 15, 2003
phpBuffer overflows in PHP before 4.3.3 have unknown impact and unknown attack vectors.CVE-2003-086010.0 HighOctober 15, 2003
php, redhat linux +1 moreCross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before...CVE-2003-0442Public exploitFix available4.3 MediumJune 20, 2003
phpBuffer overflow in openlog function for PHP 4.3.1 on Windows operating system, and possibly other...CVE-2003-0172Public exploitEPSS 19.0%7.5 HighMarch 29, 2003
phpInteger signedness error in emalloc() function for PHP before 4.3.2 allow remote attackers to...CVE-2003-0166Public exploitEPSS 14.1%7.5 HighMarch 27, 2003
phpUnknown vulnerability in CGI module for PHP 4.3.0 allows attackers to access arbitrary files as...CVE-2003-00977.5 HighMarch 3, 2003
phpHeap-based buffer overflow in the wordwrap function in PHP after 4.1.2 and before 4.3.0 may allow...CVE-2002-13967.5 HighJanuary 17, 2003
phpphp.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which...CVE-2002-2309Public exploit7.8 HighDecember 31, 2002
phpThe imap_header function in the IMAP functionality for PHP before 4.3.0 allows remote attackers...CVE-2002-22155.0 MediumDecember 31, 2002
phpThe php_if_imap_mime_header_decode function in the IMAP functionality in PHP before 4.2.2 allows...CVE-2002-22145.0 MediumDecember 31, 2002
php phpsquidpassphpSquidPass before 0.2 uses an incomplete regular expression to find a matching username in its...CVE-2002-21754.0 MediumDecember 31, 2002
phpCross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.2.3 allows remote...CVE-2002-1954Public exploitEPSS 11.9%4.3 MediumDecember 31, 2002
phpCRLF injection vulnerability in PHP 4.2.1 through 4.2.3, when allow_url_fopen is enabled, allows...CVE-2002-1783EPSS 16.7%5.0 MediumDecember 31, 2002
phpThe mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments...CVE-2002-09865.0 MediumSeptember 18, 2002
php, openpkg +1 moreArgument injection vulnerability in the mail function for PHP 4.x to 4.2.2 may allow attackers to...CVE-2002-09857.5 HighSeptember 18, 2002
phpmove_uploaded_file in PHP does not does not check for the base directory (open_basedir), which...CVE-2002-0484Public exploit5.0 MediumAugust 12, 2002
phpPHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute...CVE-2002-0717EPSS 11.0%7.5 HighJuly 23, 2002
phpPHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote...CVE-2002-02535.0 MediumMay 3, 2002
phpSafe Mode feature (safe_mode) in PHP 3.0 through 4.1.0 allows attackers with access to the MySQL...CVE-2002-0229Public exploit7.5 HighMay 3, 2002
phpPHP 4.0 through 4.1.1 stores session IDs in temporary files whose name contains the session ID,...CVE-2002-01212.1 LowMarch 25, 2002
phpBuffer overflows in (1) php_mime_split in PHP 4.1.0, 4.1.1, and 4.0.6 and earlier, and (2)...CVE-2002-0081EPSS 24.3%7.5 HighMarch 8, 2002
phpPHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the...CVE-2001-12476.4 MediumDecember 6, 2001
phpPHP 4.0.5 through 4.1.0 in safe mode does not properly cleanse the 5th parameter to the mail()...CVE-2001-1246Public exploit7.5 HighJune 30, 2001
php, mandrakesoft mandrake linux +1 morePHP Apache module 4.0.4 and earlier allows remote attackers to bypass .htaccess access...CVE-2001-01085.0 MediumMarch 12, 2001
php, mandrakesoft mandrake linux +1 moreThe Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option...CVE-2001-13855.0 MediumJanuary 12, 2001
phpPHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers...CVE-2000-0967Public exploitEPSS 20.6%10.0 HighDecember 19, 2000
phpThe file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary...CVE-2000-08605.0 MediumNovember 14, 2000
phpPHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are...CVE-2000-0059Public exploitEPSS 10.9%10.0 HighJanuary 4, 2000
phpCGI PHP mylog script allows an attacker to read any file on the target server.CVE-1999-0068Public exploit7.5 HighOctober 19, 1997
php fiCGI PHP mlog script allows an attacker to read any file on the target server.CVE-1999-03465.0 MediumOctober 16, 1997
phpphp.cgi allows attackers to read any file on the system.CVE-1999-0238Public exploit10.0 HighAugust 1, 1997
phpBuffer overflow in PHP cgi program, php.cgi allows shell access.CVE-1999-00587.5 HighApril 17, 1997