PH
Language
PHP
On CISA KEVExploited in the wildRansomware-linked
748
CVEs
6
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 133High 129Medium 67Low 4
Watch
Add PHP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-8873 | 7.5 | May 16 | Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service… Affected: before 5.4.44; 5.5.0 before 5.5.28; 5.6.0 before 5.6.12 |
| CVE-2015-6838 | 7.5 | May 16 | The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2015-6837 | 7.5 | May 16 | The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2015-4644 | 7.5 | May 16 | The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token… Affected: through 5.4.41; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +31 more |
| CVE-2015-4605 | 7.5 | May 16 | The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a… Affected: through 5.4.39; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +27 more |
| CVE-2015-4604 | 7.5 | May 16 | The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a… Affected: through 5.4.39; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +27 more |
| CVE-2014-0236 | 7.5 | May 16 | file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via… Affected: through 5.5.35 |
| CVE-2015-6833 | 7.5 | Jan 19 | Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via… Affected: through 5.4.43; 5.5.0; 5.5.0; 5.5.0; 5.5.0; 5.5.0; +34 more |
| CVE-2015-8393 | 7.5 | Dec 2 | pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a… Affected: 5.5.0 before 5.5.32; 5.6.0 before 5.6.18; 7.0.0 before 7.0.3 |
| CVE-2013-3735 | 7.5 | May 31 | The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a… Affected: through 5.4.15; 5.4.0; 5.4.1; 5.4.2; 5.4.3; 5.4.4; +25 more |
| CVE-2007-1285 | 7.5 | Mar 6 | The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays,… Affected: 4.0.0 before 4.4.7; 5.0.0 before 5.2.2 |
| CVE-2017-7272 | 7.4 | Mar 27 | PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained Affected: through 7.1.3 |
| CVE-2025-1736 | 7.3 | Mar 30 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of… Affected: 8.1.0 before 8.1.32; 8.2.0 before 8.2.28; 8.3.0 before 8.3.19; 8.4.0 before 8.4.5 |
| CVE-2015-8865 | 7.3 | May 20 | The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles… Affected: through 5.5.33; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +28 more |
| CVE-2016-1904 | 7.3 | Jan 19 | Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long… Affected: 7.0.0; 7.0.1 |
| CVE-2015-6836 | 7.3 | Jan 19 | The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 does not properly manage headers, which allows remote attackers… Affected: through 5.4.44; 5.5.0; 5.5.0; 5.5.0; 5.5.0; 5.5.0; +34 more |
| CVE-2015-6832 | 7.3 | Jan 19 | Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote… Affected: through 5.4.43; 5.5.0; 5.5.0; 5.5.0; 5.5.0; 5.5.0; +34 more |
| CVE-2015-6831 | 7.3 | Jan 19 | Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allow remote attackers to execute arbitrary code via vectors… Affected: before 5.4.44; 5.5.0 before 5.5.28; 5.6.0 before 5.6.12 |
| CVE-2015-6527 | 7.3 | Jan 19 | The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third… Affected: 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +8 more |
| CVE-2015-5590 | 7.3 | Jan 19 | Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to… Affected: through 5.4.42; 5.5.0; 5.5.0; 5.5.0; 5.5.0; 5.5.0; +34 more |
| CVE-2015-8387 | 7.3 | Dec 2 | PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, which allows remote attackers to cause a denial of service (integer overflow) or possibly have… Affected: 5.5.0 before 5.5.32; 5.6.0 before 5.6.18; 7.0.0 before 7.0.3 |
| CVE-2014-9426 | 7.3 | Dec 31 | The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation on a stack-based character array, which… Affected: through 5.6.4 |
| CVE-2024-11234 | 7.2 | Nov 24 | In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly… Affected: 8.1.0 before 8.1.31; 8.2.0 before 8.2.26; 8.3.0 before 8.3.14 |
| CVE-2022-31630 | 7.1 | Nov 14 | In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the… Affected: 7.4.0 before 7.4.33; 8.0.0 before 8.0.25; 8.1.0 before 8.1.12 |
| CVE-2019-11042 | 7.1 | Aug 9 | When PHP EXIF extension is parsing EXIF information from an image, e.g Affected: 7.1.0 before 7.1.31; 7.2.0 before 7.2.21; 7.3.0 before 7.3.8 |
| CVE-2019-11041 | 7.1 | Aug 9 | When PHP EXIF extension is parsing EXIF information from an image, e.g Affected: 7.1.0 before 7.1.31; 7.2.0 before 7.2.21; 7.3.0 before 7.3.8 |
| CVE-2016-3185 | 7.1 | May 16 | The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, 5.6.x before 5.6.12, and 7.x before 7.0.4 allows remote attackers to obtain… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2021-21703 | 7.0 | Oct 25 | In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child… Affected: 7.3.0 through 7.3.31; 7.4.0 before 7.4.25; 8.0.0 before 8.0.12 |
| CVE-2017-9067 | 7.0 | May 18 | In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary files on the web server due to insufficient validation of the action… Affected: 5.3.3 |
The 500 most important CVEs for this product (exploited first, then by severity)