Skip to contentPhp vulnerabilities
Newest
- mayurik best courier management systemSQL Injection vulnerability in Best courier management system in php v.1.0 allows a remote...CVE-2024-485809.8 Critical
- mayurik best house rental management systemSQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a...CVE-2024-485799.8 Critical
- phpPHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)CVE-2024-8926Fix available8.1 High
- phpPHP-FPM logs from children may be alteredCVE-2024-9026Fix available3.3 Low
- phpcgi.force_redirect configuration is bypassable due to the environment variable collisionCVE-2024-8927Fix available7.5 High
- phpErroneous parsing of multipart form dataCVE-2024-8925Fix available3.1 Low
- php, fedoraproject fedora +1 moreArgument Injection in PHP-CGICVE-2024-4577In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- php, fedoraproject fedora +1 moreCommand injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)CVE-2024-5585Fix availableEPSS 28.8%7.7 High
- php, fedoraproject fedora +1 moreFilter bypass in filter_var (FILTER_VALIDATE_URL)CVE-2024-5458Fix availableEPSS 12.1%5.3 Medium
- php, debian linux +1 morePHP function password_verify can erroneously return true when argument contains NULCVE-2024-3096Fix available6.5 Medium
- php group php, php archive tar +1 more__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fixCVE-2024-2756Fix availableEPSS 38.1%6.5 Medium
- php, fedoraproject fedora +1 moreCommand injection via array-ish $command parameter of proc_open()CVE-2024-1874Public exploitFix availableEPSS 32.8%9.4 Critical
- phpPHP mb_encode_mimeheader runs endlessly for some inputsCVE-2024-2757Fix available7.5 High
- go programming language golang, haskell process library, haskell programming language haskel +6 more +8 moreCommand injection vulnerability in programing languages on Microsoft Windows operating system.CVE-2024-3566Fix available9.8 Critical
- code-projects student enrollmentSQL Injection vulnerability in Student Enrollment In PHP 1.0 allows attackers to run arbitrary...CVE-2023-415048.8 High
- code-projects student enrollmentStudent Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the...CVE-2023-415039.8 Critical
- code-projects student enrollmentAn arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of...CVE-2023-415069.8 Critical
- php, fedoraproject fedora +1 morePHP is vulnerable to the Marvin AttackCVE-2024-2408Fix available5.9 Medium
- php, debian linux, fedoraproject fedora +2 moreBuffer overflow and overread in phar_dir_read()CVE-2023-3824Public exploitFix availableEPSS 21.8%9.4 Critical
- php, debian linux, fedoraproject fedora +2 moreSecurity issue with external entity loading in XML without enabling itCVE-2023-3823Fix available8.6 High
- phpMissing error check and insufficient random bytes in HTTP Digest authentication for SOAPCVE-2023-3247Fix available2.6 Low
- php, fedora, red hat enterprise linux 6 +5 more +7 morePotential buffer overflow in php_cli_server_startup_workersCVE-2022-4900Fix available6.2 Medium
- phpArray overrun in common path resolve codeCVE-2023-0568Fix available7.5 High
- phpDoS vulnerability when parsing multipart request bodyCVE-2023-0662Fix available7.5 High
- phppassword_verify() always returns true for some invalid hashesCVE-2023-0567Fix available7.7 High
- phpPDO::quote() may return unquoted stringCVE-2022-31631Fix available9.1 Critical
- phpOOB read due to insufficient input validation in imageloadfont()CVE-2022-31630Public exploitFix available6.5 Medium
- debian linux, extended keccak code package project keccak code package, fedoraproject fedora +9 more +11 moreBuffer overflow in sponge queue functionsCVE-2022-37454Fix available9.8 Critical
- php, debian linux, fedoraproject fedora +2 more$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesCVE-2022-31629Public exploitFix availableEPSS 49.6%6.5 Medium
- php, debian linux, fedoraproject fedora +2 morephar wrapper can occur dos when using quine gzip fileCVE-2022-31628Fix available2.3 Low
- phpHeap buffer overflow in finfo_bufferCVE-2022-31627Fix available7.7 High
- php, debian linux +1 moremysqlnd/pdo password buffer overflowCVE-2022-31626Public exploitFix availableEPSS 58.1%7.5 High
- php, debian linux +1 moreFreeing unallocated memory in php_pgsql_free_params()CVE-2022-31625Fix available8.1 High
- php pearwebpearweb < 1.32 suffers from Deserialization of Untrusted Data.CVE-2022-271589.8 Critical
- php pearwebpearweb < 1.32 is suffers from a Weak Password Recovery Mechanism via include/users...CVE-2022-271579.8 Critical
- php memcachedPHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to...CVE-2022-26635Fix availableDisputedEPSS 21.4%9.8 Critical
- phpUAF due to php_filter_float() failingCVE-2021-21708Fix available8.2 High
- php, debian linux, netapp clustered data ontap +1 more +3 moreSpecial characters break path parsing in XML functionsCVE-2021-21707Public exploitFix availableEPSS 25.3%5.3 Medium
- php, debian linux, fedoraproject fedora +2 more +4 morePHP-FPM memory access in root process leading to privilege escalationCVE-2021-21703Fix available7.8 High
- phpZipArchive::extractTo may extract outside of destination dirCVE-2021-21706Fix available5.3 Medium
- debian linux, fedoraproject fedora, php archive tar +2 moreDirectory Traversal in Archive_TarCVE-2021-32610Fix availableEPSS 73.4%7.1 High
- php, netapp clustered data ontap, oracle sd-wan aware +2 moreIncorrect URL validation in FILTER_VALIDATE_URLCVE-2021-21705Fix available4.3 Medium
- php, netapp clustered data ontap +1 moreMultiple vulnerabilities in Firebird client extensionCVE-2021-21704Fix available5.0 Medium
- php, debian linux, netapp clustered data ontap +1 more +3 moreNull Dereference in SoapClientCVE-2021-21702Fix available5.3 Medium
- debian linux, drupal, fedoraproject fedora +1 more +3 moreDirectory Traversal in Archive_TarCVE-2020-36193In KEVFix availableEPSS 70.6%7.5 High
- php, debian linux, netapp clustered data ontap +2 moreFILTER_VALIDATE_URL accepts URLs with invalid userinfoCVE-2020-7071Fix available5.3 Medium
- debian linux, drupal, fedoraproject fedora +1 more +3 moreDeserialization of Untrusted Data in Archive_TarCVE-2020-28948Public exploitFix availableEPSS 47.5%7.8 High
- debian linux, drupal, fedoraproject fedora +1 more +3 moreMultiple vulnerabilities through filename manipulation in Archive_TarCVE-2020-28949In KEVPublic exploitFix availableEPSS 84.6%7.8 High
- php, canonical ubuntu linux, debian linux +4 more +6 morePHP parses encoded cookie names so malicious `__Host-` cookies can be sentCVE-2020-7070Fix available4.3 Medium
- php, canonical ubuntu linux, debian linux +5 more +7 moreWrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVCVE-2020-7069Fix available5.4 Medium
- Show moreLoading…