Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

php php vulnerabilities and exploits

(subscribe to this query)

5
CVSSv2
CVE-2014-0238
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long....
Php Php 5.0.0Php Php 5.0.1Php Php 5.0.2Php Php 5.0.3Php Php 5.0.4Php Php 5.0.5Php Php 5.1.0Php Php 5.1.1Php Php 5.1.2Php Php 5.1.3Php Php 5.1.4Php Php 5.1.5Php Php 5.1.6Php Php 5.2.0Php Php 5.2.1Php Php 5.2.2Php Php 5.2.3Php Php 5.2.4Php Php 5.2.5Php Php 5.2.6Php Php 5.2.7Php Php 5.2.8Php Php 5.2.9Php Php 5.2.10Php Php 5.2.11Php Php 5.2.12Php Php 5.2.13Php Php 5.2.14Php Php 5.2.15Php Php 5.2.16Php Php 5.2.17Php Php 5.3.0Php Php 5.3.1Php Php 5.3.2Php Php 5.3.3Php Php 5.3.4Php Php 5.3.5Php Php 5.3.6Php Php 5.3.7Php Php 5.3.8Php Php 5.3.9Php Php 5.3.10Php Php 5.3.11Php Php 5.3.12Php Php 5.3.13Php Php 5.3.14Php Php 5.3.15Php Php 5.3.16Php Php 5.3.17Php Php 5.3.18Php Php 5.3.19Php Php 5.3.20Php Php 5.3.21Php Php 5.3.22Php Php 5.3.23Php Php 5.3.24Php Php 5.3.25Php Php 5.3.26Php Php 5.3.27Php PhpPhp Php 5.4.0Php Php 5.4.1Php Php 5.4.2Php Php 5.4.3Php Php 5.4.4Php Php 5.4.5Php Php 5.4.6Php Php 5.4.7Php Php 5.4.8Php Php 5.4.9Php Php 5.4.10Php Php 5.4.11Php Php 5.4.12Php Php 5.4.13Php Php 5.4.14Php Php 5.4.15Php Php 5.4.16Php Php 5.4.17Php Php 5.4.18Php Php 5.4.19Php Php 5.4.20Php Php 5.4.21Php Php 5.4.22Php Php 5.4.23Php Php 5.4.24Php Php 5.4.25Php Php 5.4.26Php Php 5.5.0Php Php 5.5.1Php Php 5.5.2Php Php 5.5.3Php Php 5.5.4Php Php 5.5.5Php Php 5.5.6Php Php 5.5.7Php Php 5.5.8Php Php 5.5.9Php Php 5.5.10Php Php 5.5.11Php Php 5.5.12
5
CVSSv2
CVE-2009-3294
The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certain Windows operating systems, allows context-dependent attackers to cause a denial of service (crash) via a crafted (1) "e" or (2) "er" string in the...
Php Php 1.0Php Php 2.0Php Php 2.0b10Php Php 3.0Php Php 3.0.1Php Php 3.0.2Php Php 3.0.3Php Php 3.0.4Php Php 3.0.5Php Php 3.0.6Php Php 3.0.7Php Php 3.0.8Php Php 3.0.9Php Php 3.0.10Php Php 3.0.11Php Php 3.0.12Php Php 3.0.13Php Php 3.0.14Php Php 3.0.15Php Php 3.0.16Php Php 3.0.17Php Php 3.0.18Php Php 4Php Php 4.0Php Php 4.0.0Php Php 4.0.1Php Php 4.0.2Php Php 4.0.3Php Php 4.0.4Php Php 4.0.5Php Php 4.0.6Php Php 4.0.7Php Php 4.1.0Php Php 4.1.1Php Php 4.1.2Php Php 4.2Php Php 4.2.0Php Php 4.2.1Php Php 4.2.2Php Php 4.2.3Php Php 4.3.0Php Php 4.3.1Php Php 4.3.2Php Php 4.3.3Php Php 4.3.4Php Php 4.3.5Php Php 4.3.6Php Php 4.3.7Php Php 4.3.8Php Php 4.3.9Php Php 4.3.10Php Php 4.3.11Php Php 4.4.0Php Php 4.4.1Php Php 4.4.2Php Php 4.4.3Php Php 4.4.4Php Php 4.4.5Php Php 4.4.6Php Php 4.4.7Php Php 4.4.8Php Php 4.4.9Php Php 5Php Php 5.0Php Php 5.0.0Php Php 5.0.1Php Php 5.0.2Php Php 5.0.3Php Php 5.0.4Php Php 5.0.5Php Php 5.1.0Php Php 5.1.1Php Php 5.1.2Php Php 5.1.3Php Php 5.1.4Php Php 5.1.5Php Php 5.1.6Php Php 5.2.0Php Php 5.2.1Php Php 5.2.2Php Php 5.2.3Php Php 5.2.4Php Php 5.2.5Php Php 5.2.6Php Php 5.2.7Php Php 5.2.8Php Php 5.2.9Php Php
7.5
CVSSv2
CVE-2016-4073
Multiple integer overflows in the mbfl_strcut function in ext/mbstring/libmbfl/mbfl/mbfilter.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted...
Php Php 5.5.0Php Php 5.5.1Php Php 5.5.2Php Php 5.5.3Php Php 5.5.4Php Php 5.5.5Php Php 5.5.6Php Php 5.5.7Php Php 5.5.8Php Php 5.5.9Php Php 5.5.10Php Php 5.5.11Php Php 5.5.12Php Php 5.5.13Php Php 5.5.14Php Php 5.5.18Php Php 5.5.19Php Php 5.5.20Php Php 5.5.21Php Php 5.5.22Php Php 5.5.23Php Php 5.5.24Php Php 5.5.25Php Php 5.5.26Php Php 5.5.27Php Php 5.5.29Php Php 5.5.30Php Php 5.5.32Php Php 5.5.33Php Php 5.6.0Php Php 5.6.1Php Php 5.6.2Php Php 5.6.3Php Php 5.6.4Php Php 5.6.5Php Php 5.6.6Php Php 5.6.7Php Php 5.6.8Php Php 5.6.9Php Php 5.6.10Php Php 5.6.11Php Php 5.6.12Php Php 5.6.13Php Php 5.6.14Php Php 5.6.15Php Php 5.6.16Php Php 5.6.17Php Php 5.6.18Php Php 5.6.19Php Php 7.0.0Php Php 7.0.1Php Php 7.0.2Php Php 7.0.3Php Php 7.0.4Apple Mac Os X
5
CVSSv2
CVE-2016-7478
Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception object in serialized data, a related issue to CVE-2015-8876....
Php Php 5.0.0Php Php 5.0.1Php Php 5.0.2Php Php 5.0.3Php Php 5.0.4Php Php 5.0.5Php Php 5.1.0Php Php 5.1.1Php Php 5.1.2Php Php 5.1.3Php Php 5.1.4Php Php 5.1.5Php Php 5.1.6Php Php 5.2.0Php Php 5.2.1Php Php 5.2.2Php Php 5.2.3Php Php 5.2.4Php Php 5.2.5Php Php 5.2.6Php Php 5.2.7Php Php 5.2.8Php Php 5.2.9Php Php 5.2.10Php Php 5.2.11Php Php 5.2.12Php Php 5.2.13Php Php 5.2.14Php Php 5.2.15Php Php 5.2.16Php Php 5.2.17Php Php 5.3.0Php Php 5.3.1Php Php 5.3.2Php Php 5.3.3Php Php 5.3.4Php Php 5.3.5Php Php 5.3.6Php Php 5.3.7Php Php 5.3.8Php Php 5.3.9Php Php 5.3.10Php Php 5.3.11Php Php 5.3.12Php Php 5.3.13Php Php 5.3.14Php Php 5.3.15Php Php 5.3.16Php Php 5.3.17Php Php 5.3.18Php Php 5.3.19Php Php 5.3.20Php Php 5.3.21Php Php 5.3.22Php Php 5.3.23Php Php 5.3.24Php Php 5.3.25Php Php 5.3.26Php Php 5.3.27Php Php 5.3.28Php Php 5.4.0Php Php 5.4.1Php Php 5.4.2Php Php 5.4.3Php Php 5.4.4Php Php 5.4.5Php Php 5.4.6Php Php 5.4.7Php Php 5.4.8Php Php 5.4.9Php Php 5.4.10Php Php 5.4.11Php Php 5.4.12Php Php 5.4.13Php Php 5.4.14Php Php 5.4.15Php Php 5.4.16Php Php 5.4.17Php Php 5.4.18Php Php 5.4.19Php Php 5.4.20Php Php 5.4.21Php Php 5.4.22Php Php 5.4.23Php Php 5.4.24Php Php 5.4.25Php Php 5.4.26Php Php 5.4.27Php Php 5.4.28Php Php 5.4.29Php Php 5.4.30Php Php 5.4.34Php Php 5.4.35Php Php 5.4.37Php Php 5.4.38Php Php 5.4.39Php Php 5.4.41Php Php 5.4.42Php Php 5.4.43Php Php 5.4.44Php Php 5.4.45Php Php 5.5.0Php Php 5.5.1Php Php 5.5.2Php Php 5.5.3Php Php 5.5.4Php Php 5.5.5Php Php 5.5.6Php Php 5.5.7Php Php 5.5.8Php Php 5.5.9Php Php 5.5.10Php Php 5.5.11Php Php 5.5.12Php Php 5.5.13Php Php 5.5.14Php Php 5.5.18Php Php 5.5.19Php Php 5.5.20Php Php 5.5.21Php Php 5.5.22Php Php 5.5.23Php Php 5.5.24Php Php 5.5.25Php Php 5.5.26Php Php 5.5.27Php Php 5.5.28Php Php 5.5.29Php Php 5.5.30Php Php 5.5.31Php Php 5.5.32Php Php 5.5.33Php Php 5.5.34Php Php 5.5.35Php Php 5.5.36Php Php 5.5.37Php Php 5.6.0Php Php 5.6.1Php Php 5.6.2Php Php 5.6.10Php Php 5.6.11Php Php 5.6.12Php Php 5.6.13Php Php 5.6.14Php Php 5.6.15Php Php 5.6.16Php Php 5.6.17Php Php 5.6.18Php Php 5.6.19Php Php 5.6.20Php Php 5.6.21Php Php 5.6.22Php Php 5.6.23Php Php 5.6.24Php Php 5.6.25Php Php 5.6.26Php Php 5.6.27Php Php 7.0.0Php Php 7.0.1Php Php 7.0.2Php Php 7.0.3Php Php 7.0.4Php Php 7.0.5Php Php 7.0.6Php Php 7.0.7Php Php 7.0.8Php Php 7.0.9Php Php 7.0.10Php Php 7.0.11Php Php 7.0.12
4.4
CVSSv2
CVE-2011-0754
The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross-platform differences in the stat...
Php Php 1.0Php Php 2.0Php Php 2.0b10Php Php 3.0Php Php 3.0.1Php Php 3.0.2Php Php 3.0.3Php Php 3.0.4Php Php 3.0.5Php Php 3.0.6Php Php 3.0.7Php Php 3.0.8Php Php 3.0.9Php Php 3.0.10Php Php 3.0.11Php Php 3.0.12Php Php 3.0.13Php Php 3.0.14Php Php 3.0.15Php Php 3.0.16Php Php 3.0.17Php Php 3.0.18Php Php 4.0Php Php 4.0.0Php Php 4.0.1Php Php 4.0.2Php Php 4.0.3Php Php 4.0.4Php Php 4.0.5Php Php 4.0.6Php Php 4.0.7Php Php 4.1.0Php Php 4.1.1Php Php 4.1.2Php Php 4.2.0Php Php 4.2.1Php Php 4.2.2Php Php 4.2.3Php Php 4.3.0Php Php 4.3.1Php Php 4.3.2Php Php 4.3.3Php Php 4.3.4Php Php 4.3.5Php Php 4.3.6Php Php 4.3.7Php Php 4.3.8Php Php 4.3.9Php Php 4.3.10Php Php 4.3.11Php Php 4.4.0Php Php 4.4.1Php Php 4.4.2Php Php 4.4.3Php Php 4.4.4Php Php 4.4.5Php Php 4.4.6Php Php 4.4.7Php Php 4.4.8Php Php 4.4.9Php Php 5.3.0Php Php 5.3.1Php Php 5.3.2Php Php
5
CVSSv2
CVE-2012-1171
The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving a stream_close method call during use of a custom stream wrapper....
Php Php 5.0.0Php Php 5.0.1Php Php 5.0.2Php Php 5.0.3Php Php 5.0.4Php Php 5.0.5Php Php 5.1.0Php Php 5.1.1Php Php 5.1.2Php Php 5.1.3Php Php 5.1.4Php Php 5.1.5Php Php 5.1.6Php Php 5.2.0Php Php 5.2.1Php Php 5.2.2Php Php 5.2.3Php Php 5.2.4Php Php 5.2.5Php Php 5.2.6Php Php 5.2.7Php Php 5.2.8Php Php 5.2.9Php Php 5.2.10Php Php 5.2.11Php Php 5.2.12Php Php 5.2.13Php Php 5.2.14Php Php 5.2.15Php Php 5.2.16Php Php 5.2.17Php Php 5.3.0Php Php 5.3.1Php Php 5.3.2Php Php 5.3.3Php Php 5.3.4Php Php 5.3.5Php Php 5.3.6Php Php 5.3.7Php Php 5.3.8Php Php 5.3.9Php Php 5.3.10Php Php 5.3.11Php Php 5.3.12Php Php 5.3.13Php Php 5.3.14Php Php 5.3.15Php Php 5.3.16Php Php 5.3.17Php Php 5.3.18Php Php 5.3.19Php Php 5.3.20Php Php 5.3.21Php Php 5.3.22Php Php 5.3.23Php Php 5.3.24Php Php 5.3.25Php Php 5.3.26Php Php 5.3.27Php Php 5.4.0Php Php 5.4.1Php Php 5.4.2Php Php 5.4.3Php Php 5.4.4Php Php 5.4.5Php Php 5.4.6Php Php 5.4.7Php Php 5.4.8Php Php 5.4.9Php Php 5.4.10Php Php 5.4.11Php Php 5.4.12Php Php 5.4.13Php Php 5.4.14Php Php 5.4.15Php Php 5.4.16Php Php 5.4.17Php Php 5.4.18Php Php 5.4.19Php Php 5.4.20Php Php 5.4.21Php Php 5.4.22Php Php 5.4.23Php Php 5.5.0Php Php 5.5.1Php Php 5.5.2Php Php 5.5.3Php Php 5.5.4Php Php 5.5.5Php Php 5.5.6
5
CVSSv2
CVE-2006-7243
PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypass intended access restrictions by placing a safe file extension after this character, as demonstrated by .php\0.jpg at the end of the argument to the file_exists...
Php Php 1.0Php Php 2.0Php Php 2.0b10Php Php 3.0Php Php 3.0.1Php Php 3.0.2Php Php 3.0.3Php Php 3.0.4Php Php 3.0.5Php Php 3.0.6Php Php 3.0.7Php Php 3.0.8Php Php 3.0.9Php Php 3.0.10Php Php 3.0.11Php Php 3.0.12Php Php 3.0.13Php Php 3.0.14Php Php 3.0.15Php Php 3.0.16Php Php 3.0.17Php Php 3.0.18Php Php 4.0Php Php 4.0.0Php Php 4.0.1Php Php 4.0.2Php Php 4.0.3Php Php 4.0.4Php Php 4.0.5Php Php 4.0.6Php Php 4.0.7Php Php 4.1.0Php Php 4.1.1Php Php 4.1.2Php Php 4.2.0Php Php 4.2.1Php Php 4.2.2Php Php 4.2.3Php Php 4.3.0Php Php 4.3.1Php Php 4.3.2Php Php 4.3.3Php Php 4.3.4Php Php 4.3.5Php Php 4.3.6Php Php 4.3.7Php Php 4.3.8Php Php 4.3.9Php Php 4.3.10Php Php 4.3.11Php Php 4.4.0Php Php 4.4.1Php Php 4.4.2Php Php 4.4.3Php Php 4.4.4Php Php 4.4.5Php Php 4.4.6Php Php 4.4.7Php Php 4.4.8Php Php 4.4.9Php Php 5.0.0Php Php 5.0.1Php Php 5.0.2Php Php 5.0.3Php Php 5.0.4Php Php 5.0.5Php Php 5.1.0Php Php 5.1.1Php Php 5.1.2Php Php 5.1.3Php Php 5.1.4Php Php 5.1.5Php Php 5.1.6Php Php 5.2.0Php Php 5.2.1Php Php 5.2.2Php Php 5.2.3Php Php 5.2.4Php Php 5.2.5Php Php 5.2.6Php Php 5.2.7Php Php 5.2.8Php Php 5.2.9Php Php 5.2.10Php Php 5.2.11Php Php 5.2.12Php Php 5.2.13Php Php 5.2.14Php Php 5.2.15Php Php 5.2.16Php Php 5.2.17Php Php 5.3.0Php Php 5.3.1Php Php 5.3.2Php Php
6.8
CVSSv2
CVE-2010-3870
The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill-formed subsequences in UTF-8 data, which makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted...
Php Php 1.0Php Php 2.0Php Php 2.0b10Php Php 3.0Php Php 3.0.1Php Php 3.0.2Php Php 3.0.3Php Php 3.0.4Php Php 3.0.5Php Php 3.0.6Php Php 3.0.7Php Php 3.0.8Php Php 3.0.9Php Php 3.0.10Php Php 3.0.11Php Php 3.0.12Php Php 3.0.13Php Php 3.0.14Php Php 3.0.15Php Php 3.0.16Php Php 3.0.17Php Php 3.0.18Php Php 4.0Php Php 4.0.0Php Php 4.0.1Php Php 4.0.2Php Php 4.0.3Php Php 4.0.4Php Php 4.0.5Php Php 4.0.6Php Php 4.0.7Php Php 4.1.0Php Php 4.1.1Php Php 4.1.2Php Php 4.2.0Php Php 4.2.1Php Php 4.2.2Php Php 4.2.3Php Php 4.3.0Php Php 4.3.1Php Php 4.3.2Php Php 4.3.3Php Php 4.3.4Php Php 4.3.5Php Php 4.3.6Php Php 4.3.7Php Php 4.3.8Php Php 4.3.9Php Php 4.3.10Php Php 4.3.11Php Php 4.4.0Php Php 4.4.1Php Php 4.4.2Php Php 4.4.3Php Php 4.4.4Php Php 4.4.5Php Php 4.4.6Php Php 4.4.7Php Php 4.4.8Php Php 4.4.9Php Php 5.0.0Php Php 5.0.1Php Php 5.0.2Php Php 5.0.3Php Php 5.0.4Php Php 5.0.5Php Php 5.1.0Php Php 5.1.1Php Php 5.1.2Php Php 5.1.3Php Php 5.1.4Php Php 5.1.5Php Php 5.1.6Php Php 5.2.0Php Php 5.2.1Php Php 5.2.2Php Php 5.2.3Php Php 5.2.4Php Php 5.2.5Php Php 5.2.6Php Php 5.2.7Php Php 5.2.8Php Php 5.2.9Php Php 5.2.10Php Php 5.2.11Php Php 5.2.12Php Php 5.2.13Php Php 5.2.14Php Php 5.2.15Php Php 5.2.16Php Php 5.2.17Php Php 5.3.0Php Php 5.3.1Php Php 5.3.2Php Php
6.4
CVSSv2
CVE-2012-0057
PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension....
Php Php 5.0.0Php Php 5.0.1Php Php 5.0.2Php Php 5.0.3Php Php 5.0.4Php Php 5.0.5Php Php 5.1.0Php Php 5.1.1Php Php 5.1.2Php Php 5.1.3Php Php 5.1.4Php Php 5.1.5Php Php 5.1.6Php Php 5.2.0Php Php 5.2.1Php Php 5.2.2Php Php 5.2.3Php Php 5.2.4Php Php 5.2.5Php Php 5.2.6Php Php 5.2.7Php Php 5.2.8Php Php 5.2.9Php Php 5.2.10Php Php 5.2.11Php Php 5.2.12Php Php 5.2.13Php Php 5.2.14Php Php 5.2.15Php Php 5.2.16Php Php 5.2.17Php Php 5.3.0Php Php 5.3.1Php Php 5.3.2Php Php 5.3.3Php Php 5.3.4Php Php 5.3.5Php Php 5.3.6Php Php 5.3.7Php Php
7.5
CVSSv2
CVE-2007-4658
The money_format function in PHP 5 before 5.2.4, and PHP 4 before 4.4.8, permits multiple (1) %i and (2) %n tokens, which has unknown impact and attack vectors, possibly related to a format string vulnerability....
Php Php 5.0.0Php Php 5.0.1Php Php 5.0.2Php Php 5.0.3Php Php 5.0.4Php Php 5.0.5Php Php 5.1.0Php Php 5.1.1Php Php 5.1.2Php Php 5.1.3Php Php 5.1.4Php Php 5.1.5Php Php 5.1.6Php Php 5.2.0Php Php 5.2.1Php Php 5.2.2Php Php 5.2.3Php Php 5.2.10Php Php 5.2.11Php Php 5.2.12Php Php 5.2.13Php Php 5.2.14Php Php 4.0Php Php 4.0.0Php Php 4.0.1Php Php 4.0.2Php Php 4.0.3Php Php 4.0.4Php Php 4.0.5Php Php 4.0.6Php Php 4.0.7Php Php 4.1.0Php Php 4.1.1Php Php 4.1.2Php Php 4.2.0Php Php 4.2.1Php Php 4.2.2Php Php 4.2.3Php Php 4.3.0Php Php 4.3.1Php Php 4.3.2Php Php 4.3.3Php Php 4.3.4Php Php 4.3.5Php Php 4.3.6Php Php 4.3.7Php Php 4.3.8Php Php 4.3.9Php Php 4.3.10Php Php 4.3.11Php Php 4.4.0Php Php 4.4.1Php Php 4.4.2Php Php 4.4.3Php Php 4.4.4Php Php 4.4.5Php Php 4.4.6Php Php 4.4.7
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
XXECVE-2021-21973mass assignmentCVE-2021-1396CVE-2018-19518CVE-2020-28599deserializationCVE-2021-1230CVE-2021-26681