PH
Product
Phpunit
On CISA KEVExploited in the wild
4
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 0Low 0
Watch
Add Phpunit to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-9841 In wildKEV | 9.8 | Jun 27 | Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring,… Affected: through 4.8.27; 5.0.0 before 5.6.3 |
| CVE-2026-41570 | 7.8 | May 8 | PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes Affected: 12.5.21; 13.1.5 |
| CVE-2026-24765 | 7.8 | Jan 27 | PHPUnit is a testing framework for PHP Affected: before 8.5.52; 9.0.0 before 9.6.33; 10.0.0 before 10.5.62; 11.0.0 before 11.5.50; 12.0.0 before 12.5.8 |
| CVE-2013-4744 | – | Jul 1 | Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: before 3.5.15 |
Showing 4