PH
Language
PHP
On CISA KEVExploited in the wildRansomware-linked
748
CVEs
6
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 133High 129Medium 67Low 4
Watch
Add PHP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-8925 | 5.3 | Oct 8 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate… Affected: 8.1.0 before 8.1.30; 8.2.0 before 8.2.24; 8.3.0 before 8.3.12 |
| CVE-2024-5458 | 5.3 | Jun 9 | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating… Affected: 7.3.27 through 7.3.33; 7.4.15 through 7.4.33; 8.0.2 through 8.0.30; 8.1.0 before 8.1.29; 8.2.0 before 8.2.20; 8.3.0 before 8.3.8 |
| CVE-2021-21707 | 5.3 | Nov 29 | In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them Affected: 7.3.0 before 7.3.33; 7.4.0 before 7.4.26; 8.0.0 before 8.0.13 |
| CVE-2021-21705 | 5.3 | Oct 4 | In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter,… Affected: 7.3.0 before 7.3.29; 7.4.0 before 7.4.21; 8.0.0 before 8.0.8 |
| CVE-2020-7071 | 5.3 | Feb 15 | In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with… Affected: 7.3.0 before 7.3.26; 7.4.0 before 7.4.14; 8.0.0 before 8.0.1 |
| CVE-2020-7070 | 5.3 | Oct 2 | In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded Affected: 7.2.0 before 7.2.34; 7.3.0 before 7.3.23; 7.4.0 before 7.4.11 |
| CVE-2019-11048 | 5.3 | May 20 | In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP… Affected: 7.2.0 before 7.2.31; 7.3.0 before 7.3.18; 7.4.0 before 7.4.6 |
| CVE-2020-7063 | 5.3 | Feb 27 | In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with… Affected: 7.2.0 through 7.2.27; 7.3.0 through 7.3.14; 7.4.0 through 7.4.2 |
| CVE-2019-11046 | 5.3 | Dec 23 | In PHP versions 7.2.x below 7.2.26, 7.3.x below 7.3.13 and 7.4.0, PHP bcmath extension functions on some systems, including Windows, can be tricked into reading beyond the… Affected: 7.2.0 through 7.2.26; 7.3.0 through 7.3.13; 7.4.0 |
| CVE-2019-11038 | 5.3 | Jun 19 | When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19… Affected: 7.1.0 before 7.1.30; 7.2.0 before 7.2.19; 7.3.0 before 7.3.6 |
| CVE-2016-7128 | 5.3 | Sep 12 | The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which… Affected: through 5.6.24; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +5 more |
| CVE-2015-3412 | 5.3 | May 16 | PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via… Affected: through 5.4.39; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +27 more |
| CVE-2018-10545 | 4.7 | Apr 29 | An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4 Affected: before 5.6.35; 7.0.0 before 7.0.29; 7.1.0 before 7.1.16; 7.2.0 before 7.2.4 |
| CVE-2026-91769 | 4.3 | Sep 25 | TLS Hostname Verification Falls Back to CN After SAN Mismatch Affected: 8.2.* before 8.2.34; 8.3.* before 8.3.35; 8.4.* before 8.4.26; 8.5.* before 8.5.11 |
| CVE-2023-3247 | 4.3 | Jul 22 | In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and… Affected: 8.0.0 before 8.0.29; 8.1.0 before 8.1.20; 8.2.0 before 8.2.7 |
| CVE-2020-7066 | 4.3 | Apr 1 | In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL… Affected: 7.2.0 before 7.2.29; 7.3.0 before 7.3.16; 7.4.0 before 7.4.4 |
| CVE-2014-9767 | 4.3 | May 22 | Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 and… Affected: through 5.4.45; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +34 more |
The 500 most important CVEs for this product (exploited first, then by severity)