Login Request a demo
PH
Vendor
PHP
25 products with CVEs on record
782
CVEs
8
On KEV
4
New 30D
Products
PH
PHP
Language
9.8
748 CVEs6 on KEV4 new
AT
Archive Tar
Php
7.8
4 CVEs2 on KEV0 new
PE
Pear
Php
7.5
5 CVEs0 on KEV0 new
FR
Frankenphp
Php
9.8
2 CVEs0 on KEV0 new
PE
Pearweb
Php
9.8
2 CVEs0 on KEV0 new
PS
Php Script Index
Php
–
2 CVEs0 on KEV0 new
AS
Animated Smiley Generator
Php
–
1 CVEs0 on KEV0 new
AM
AR Memberscript
Php
–
1 CVEs0 on KEV0 new
BC
Blog Cms
Php
–
1 CVEs0 on KEV0 new
BL
Bloq
Php
–
1 CVEs0 on KEV0 new
CE
Com Extensions
Php
–
1 CVEs0 on KEV0 new
DL
Directory Listing Script
Php
–
1 CVEs0 on KEV0 new
ER
Errordocs
Php
–
1 CVEs0 on KEV0 new
EX
Ext-http
Php
9.8
1 CVEs0 on KEV0 new
FM
F1 Maxs File Uploader
Php
–
1 CVEs0 on KEV0 new
IM
Imagick
Php
9.8
1 CVEs0 on KEV0 new
ME
Memcached
Php
9.8
1 CVEs0 on KEV0 new
MB
Mysql Banner Exchange
Php
–
1 CVEs0 on KEV0 new
ME
Mysql Extension
Php
–
1 CVEs0 on KEV0 new
PA
Pear Archive Tar
Php
8.8
1 CVEs0 on KEV0 new
PH
Pecl Http
Php
9.8
1 CVEs0 on KEV0 new
PF
Php FI
Php
–
1 CVEs0 on KEV0 new
PH
Phpsquidpass
Php
–
1 CVEs0 on KEV0 new
XH
Xhprof
Php
–
1 CVEs0 on KEV0 new
XR
Xml Rpc
Php
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-109619
In wildKEVNew
PH
PHP
PHP
8.1
100%
Oct 21RCE via stale global state
CVE-2026-109618
In wildKEVNew
PH
PHP
PHP
9.8
100%
Oct 21RCE via OOM corruption
CVE-2026-85733
PH
PHP
PHP
5.3
0%
Oct 13FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
CVE-2026-82416
PH
PHP
PHP
7.7
0%
Oct 13FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
CVE-2026-92842
PH
PHP
PHP
5.9
0%
Sep 25OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
CVE-2026-91768
PH
PHP
PHP
6.5
0%
Sep 25IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
CVE-2026-91769
PH
PHP
PHP
4.3
0%
Sep 25TLS Hostname Verification Falls Back to CN After SAN Mismatch
CVE-2026-91767
PH
PHP
PHP
6.5
0%
Sep 25Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
CVE-2025-1218
PH
PHP
PHP
5.9
0%
Sep 25Various packet overreads in mysqlnd_writeprotocol.c
CVE-2026-91766
PH
PHP
PHP
5.9
0%
Sep 25Cross-origin credential leak in HTTP stream wrapper redirects
CVE-2026-91765
PH
PHP
PHP
7.5
0%
Sep 25SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
CVE-2025-14181
PH
PHP
PHP
6.5
0%
Sep 25Integer overflow to buffer overflow in soap HTTP parsing
CVE-2026-17545
PH
PHP
PHP
7.5
0%
Sep 25PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
CVE-2026-6103
PH
PHP
PHP
3.3
0%
Sep 25Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
CVE-2026-93682
PH
PHP
PHP
5.8
0%
Sep 25Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
CVE-2026-7260
PH
PHP
PHP
5.5
0%
Jul 30Stack overflow in phar with circular symlinks
CVE-2026-17544
PH
PHP
PHP
9.8
0%
Jul 30Out-of-bounds write in bccomp() via crafted operand and scale
CVE-2026-17543
PH
PHP
PHP
9.8
0%
Jul 30SQL injection in ext-pgsql via E'...' backslash breakout
CVE-2026-14355
PH
PHP
PHP
5.3
0%
Jul 3ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD
CVE-2026-45062
PH
PHP
PHP
8.1
1%
Jun 10FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
CVE-2026-7263
PH
PHP
PHP
7.5
0%
May 10DoS attack via DOMNode::C14N()
CVE-2026-6104
PH
PHP
PHP
9.1
0%
May 10Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
CVE-2026-7258
PH
PHP
PHP
7.5
0%
May 10Out-of-bounds read in urldecode() on NetBSD
CVE-2026-6722
PH
PHP
PHP
9.8
1%
May 10Use-After-Free in SOAP using Apache map
CVE-2026-7259
PH
PHP
PHP
6.5
0%
May 10Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
CVE-2026-7261
PH
PHP
PHP
9.8
0%
May 10SoapServer session-persisted object use-after-free via SOAP header fault
CVE-2026-7262
PH
PHP
PHP
7.5
1%
May 10NULL pointer dereference in SOAP apache:Map decoder with missing <value>
CVE-2025-14179
PH
PHP
PHP
9.8
0%
May 10SQL injection in pdo_firebird via NUL bytes in quoted strings
CVE-2026-7568
PH
PHP
PHP
7.5
0%
May 10Signed integer overflow in metaphone()
CVE-2026-6735
PH
PHP
PHP
6.1
0%
May 10XSS within PHP-FPM status endpoint
CVE-2026-24895
FR
Frankenphp
Php
9.8
1%
Feb 12FrankenPHP is a modern application server for PHP
CVE-2026-24894
FR
Frankenphp
Php
7.5
0%
Feb 12FrankenPHP is a modern application server for PHP
CVE-2025-14180
PH
PHP
PHP
7.5
1%
Dec 27In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with…
CVE-2025-14178
PH
PHP
PHP
8.2
0%
Dec 27In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the…
CVE-2025-14177
PH
PHP
PHP
7.5
1%
Dec 27In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap…
CVE-2025-1735
PH
PHP
PHP
7.5
1%
Jul 13In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions…
CVE-2025-1220
PH
PHP
PHP
5.3
1%
Jul 13In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does…
CVE-2025-6491
PH
PHP
PHP
5.9
1%
Jul 13In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace…
CVE-2024-11235
PH
PHP
PHP
8.1
1%
Apr 4In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability
CVE-2025-1861
PH
PHP
PHP
9.8
1%
Mar 30In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there…
CVE-2025-1736
PH
PHP
PHP
7.3
1%
Mar 30In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of…
CVE-2025-1734
PH
PHP
PHP
5.3
1%
Mar 30In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon…
CVE-2025-1219
PH
PHP
PHP
5.3
1%
Mar 30In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML…
CVE-2025-1217
PH
PHP
PHP
3.1
1%
Mar 29In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server,…
CVE-2022-31631
PH
PHP
PHP
9.1
2%
Feb 12In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long…
CVE-2024-11233
PH
PHP
PHP
8.2
2%
Nov 24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread…
CVE-2024-11236
PH
PHP
PHP
9.8
2%
Nov 24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer…
CVE-2024-11234
PH
PHP
PHP
7.2
1%
Nov 24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly…
CVE-2024-8929
PH
PHP
PHP
5.8
2%
Nov 22In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from…
CVE-2024-8932
PH
PHP
PHP
9.8
1%
Nov 22In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer…
CVE-2024-9026
PH
PHP
PHP
3.3
0%
Oct 8In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output =…
CVE-2024-8927
PH
PHP
PHP
7.5
1%
Oct 8In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP…
CVE-2024-8926
PH
PHP
PHP
8.8
4%
Oct 8In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577…
CVE-2024-8925
PH
PHP
PHP
5.3
1%
Oct 8In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate…
CVE-2024-2408
PH
PHP
PHP
5.9
1%
Jun 9The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an…
CVE-2024-4577
RansomwareIn wildKEV
PH
PHP
PHP
9.8
100%
Jun 9Argument Injection in PHP-CGI
CVE-2024-5585
PH
PHP
PHP
8.8
29%
Jun 9In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces
CVE-2024-5458
PH
PHP
PHP
5.3
12%
Jun 9In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating…
CVE-2024-3096
PH
PHP
PHP
6.5
1%
Apr 29In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as…
CVE-2024-2757
PH
PHP
PHP
7.5
2%
Apr 29In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space