PH
Language
PHP
On CISA KEVExploited in the wildRansomware-linked
750
CVEs
6
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 134High 130Medium 67Low 4
Watch
Add PHP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-15132 | 7.5 | Aug 7 | An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 Affected: before 5.6.37; 7.0.0 before 7.0.31; 7.1.0 before 7.1.20; 7.2.0 before 7.2.8 |
| CVE-2018-14884 | 7.5 | Aug 3 | An issue was discovered in PHP 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1 Affected: 7.0.0 before 7.0.27; 7.1.0 before 7.1.13; 7.2.0 before 7.2.1 |
| CVE-2018-14883 | 7.5 | Aug 3 | An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8 Affected: before 5.6.37; 7.0.0 before 7.0.31; 7.1.0 before 7.1.20; 7.2.0 before 7.2.8 |
| CVE-2017-9118 | 7.5 | Aug 2 | PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call Affected: 7.4.0 before 7.4.27; 8.0.0 before 8.0.14; 8.1.0 before 8.1.1; 7.1.5 |
| CVE-2018-10548 | 7.5 | Apr 29 | An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5 Affected: before 5.6.36; 7.0.0 before 7.0.30; 7.1.0 before 7.1.17; 7.2.0 before 7.2.5 |
| CVE-2018-10546 | 7.5 | Apr 29 | An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5 Affected: before 5.6.36; 7.0.0 before 7.0.30; 7.1.0 before 7.1.17; 7.2.0 before 7.2.5 |
| CVE-2016-10712 | 7.5 | Feb 9 | In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_data can be controlled if the input can be controlled (e.g., during… Affected: through 5.5.31; 5.6.0 through 5.6.17; 7.0.0 through 7.0.2 |
| CVE-2017-16642 | 7.5 | Nov 7 | In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_meridian handling of 'front of' and 'back of' directives could be used… Affected: before 5.6.32; 7.0.0 before 7.0.25; 7.1.0 before 7.1.11 |
| CVE-2017-12934 | 7.5 | Aug 18 | ext/standard/var_unserializer.re in PHP 7.0.x before 7.0.21 and 7.1.x before 7.1.7 is prone to a heap use after free while unserializing untrusted data, related to the… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +22 more |
| CVE-2017-11145 | 7.5 | Jul 10 | In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meridian parsing code could be used by attackers able to supply date… Affected: through 5.6.30; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +23 more |
| CVE-2017-11144 | 7.5 | Jul 10 | In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did not check the return value of the OpenSSL sealing function, which could… Affected: through 5.6.30; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +23 more |
| CVE-2017-11143 | 7.5 | Jul 10 | In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attackers able to inject XML for deserialization to crash the PHP… Affected: through 5.6.30 |
| CVE-2017-11142 | 7.5 | Jul 10 | In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumption denial of service attack by injecting long form variables, related… Affected: through 5.6.30; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +15 more |
| CVE-2016-10397 | 7.5 | Jul 10 | In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to bypass hostname-specific URL checks, as… Affected: through 5.6.27; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +8 more |
| CVE-2017-9229 | 7.5 | May 24 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5 Affected: through 7.1.5; 5.6.0 before 5.6.31; 7.0.0 before 7.0.21; 7.1.0 before 7.1.7 |
| CVE-2017-7963 | 7.5 | Apr 19 | The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via… Affected: through 7.1.4 |
| CVE-2017-6441 | 7.5 | Apr 3 | The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted use of… Affected: 7.1.2 |
| CVE-2015-8994 | 7.5 | Mar 2 | An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled Affected: 5.0.0 through 5.6.29; 7.0.0 before 7.0.14 |
| CVE-2016-10162 | 7.5 | Jan 24 | The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +10 more |
| CVE-2016-10161 | 7.5 | Jan 24 | The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of… Affected: through 5.6.29; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +11 more |
| CVE-2016-10159 | 7.5 | Jan 24 | Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory… Affected: through 5.6.29; 7.0.0 before 7.0.15; 7.1.0 |
| CVE-2016-10158 | 7.5 | Jan 24 | The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service… Affected: through 5.6.29; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +11 more |
| CVE-2016-7478 | 7.5 | Jan 11 | Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a crafted Exception… Affected: 5.0.0; 5.0.0; 5.0.0; 5.0.0; 5.0.0; 5.0.0; +34 more |
| CVE-2016-9934 | 7.5 | Jan 4 | ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) via crafted serialized data in a… Affected: through 5.6.27; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +8 more |
| CVE-2016-7418 | 7.5 | Sep 17 | The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial of service (invalid pointer access and… Affected: through 5.6.25; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +6 more |
| CVE-2016-7416 | 7.5 | Sep 17 | ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to the Locale class in the ICU library,… Affected: through 5.6.25; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +6 more |
| CVE-2016-7132 | 7.5 | Sep 12 | ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +5 more |
| CVE-2016-7131 | 7.5 | Sep 12 | ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly have… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +5 more |
| CVE-2016-7130 | 7.5 | Sep 12 | The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of service (NULL pointer dereference and… Affected: through 5.6.24; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +5 more |
| CVE-2016-7125 | 7.5 | Sep 12 | ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject… Affected: through 5.6.24; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +5 more |
| CVE-2015-8879 | 7.5 | May 22 | The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR columns, which allows remote attackers to cause a denial of… Affected: before 5.5.38; 5.6.0 before 5.6.12 |
| CVE-2015-8877 | 7.5 | May 22 | The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free… Affected: through 5.6.11 |
| CVE-2015-8867 | 7.5 | May 22 | The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated… Affected: 5.4.0 before 5.4.44; 5.5.0 before 5.5.28; 5.6.0 before 5.6.12 |
| CVE-2016-4070 | 7.5 | May 20 | Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 allows remote attackers to cause a denial… Affected: through 5.5.33; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +28 more |
| CVE-2015-8874 | 7.5 | May 16 | Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltoborder call Affected: through 5.6.11 |
| CVE-2015-8873 | 7.5 | May 16 | Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to cause a denial of service… Affected: before 5.4.44; 5.5.0 before 5.5.28; 5.6.0 before 5.6.12 |
| CVE-2015-6838 | 7.5 | May 16 | The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2015-6837 | 7.5 | May 16 | The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxml2 before 2.9.2 is used, does not… Affected: 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +34 more |
| CVE-2015-4644 | 7.5 | May 16 | The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not validate token… Affected: through 5.4.41; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +31 more |
| CVE-2015-4605 | 7.5 | May 16 | The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a… Affected: through 5.4.39; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +27 more |
| CVE-2015-4604 | 7.5 | May 16 | The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a… Affected: through 5.4.39; 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; +27 more |
| CVE-2014-0236 | 7.5 | May 16 | file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via… Affected: through 5.5.35 |
| CVE-2015-6833 | 7.5 | Jan 19 | Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via… Affected: through 5.4.43; 5.5.0; 5.5.0; 5.5.0; 5.5.0; 5.5.0; +34 more |
| CVE-2015-8393 | 7.5 | Dec 2 | pcregrep in PCRE before 8.38 mishandles the -q option for binary files, which might allow remote attackers to obtain sensitive information via a crafted file, as demonstrated by a… Affected: 5.5.0 before 5.5.32; 5.6.0 before 5.6.18; 7.0.0 before 7.0.3 |
| CVE-2013-3735 | 7.5 | May 31 | The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows context-dependent attackers to cause a… Affected: through 5.4.15; 5.4.0; 5.4.1; 5.4.2; 5.4.3; 5.4.4; +25 more |
| CVE-2007-1285 | 7.5 | Mar 6 | The Zend Engine in PHP 4.x before 4.4.7, and 5.x before 5.2.2, allows remote attackers to cause a denial of service (stack exhaustion and PHP crash) via deeply nested arrays,… Affected: 4.0.0 before 4.4.7; 5.0.0 before 5.2.2 |
| CVE-2017-7272 | 7.4 | Mar 27 | PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that the port number is constrained Affected: through 7.1.3 |
| CVE-2025-1736 | 7.3 | Mar 30 | In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of… Affected: 8.1.0 before 8.1.32; 8.2.0 before 8.2.28; 8.3.0 before 8.3.19; 8.4.0 before 8.4.5 |
| CVE-2015-8865 | 7.3 | May 20 | The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5, mishandles… Affected: through 5.5.33; 5.6.0; 5.6.0; 5.6.0; 5.6.0; 5.6.0; +28 more |
| CVE-2016-1904 | 7.3 | Jan 19 | Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long… Affected: 7.0.0; 7.0.1 |
The 500 most important CVEs for this product (exploited first, then by severity)