TH
Product
ThinkPHP
On CISA KEVExploited in the wild
27
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 21High 5Medium 1Low 0
Watch
Add ThinkPHP to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-9082 In wildKEV | 8.8 | Feb 24 | ThinkPHP Remote Code Execution Vulnerability Affected: before 3.2.4 |
| CVE-2022-44289 | 8.8 | Dec 6 | Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell Affected: 5.0.24; 5.1.41 |
| CVE-2021-44892 | 8.8 | Feb 10 | A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges Affected: 3.2.3 |
| CVE-2025-63889 | 7.5 | Nov 20 | The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value Affected: 5.0.24 |
| CVE-2022-25481 | 7.5 | Mar 21 | ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter Affected: 5.0.24 |
Showing 5