Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 765

Export CSV
CVE-2025-1220

Null byte termination in hostnames

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Php
Products
Php
CVE-2024-1874

Command injection via array-ish $command parameter of proc_open()

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

CVSS 3.1 · 9.4 Critical EPSS 32.8% KEV · Not listed
Vendors
Fedoraproject Php Php Group
Products
Fedora Php Php
CVE-2024-3096

PHP function password_verify can erroneously return true when argument contains NUL

In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Php Php Group and 1 more
Products
Debian Linux Php Php and 1 more
CVE-2024-2757

PHP mb_encode_mimeheader runs endlessly for some inputs

In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Php
Products
Php
CVE-2022-31629

$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities

In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.

CVSS 3.1 · 6.5 Medium EPSS 49.6% KEV · Not listed
Vendors
Debian Fedoraproject Php and 1 more
Products
Debian Linux Fedora Php and 1 more
CVE-2024-9026

PHP-FPM logs from children may be altered

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2024-8932

OOB access in ldap_escape

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Netapp Php Php Group
Products
Ontap Php Php
CVE-2024-8929

Leak partial content of the heap through heap buffer over-read in mysqlnd

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.

CVSS 3.1 · 5.8 Medium EPSS 2.2% KEV · Not listed
Vendors
Php Php Group Redhat
Products
Php Php Enterprise Linux
CVE-2024-8927

cgi.force_redirect configuration is bypassable due to the environment variable collision

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2024-8926

PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

CVSS 3.1 · 8.1 High EPSS 3.7% KEV · Not listed
Vendors
Php
Products
Php
CVE-2024-8925

Erroneous parsing of multipart form data

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux
CVE-2024-5458

Filter bypass in filter_var (FILTER_VALIDATE_URL)

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.

CVSS 3.1 · 5.3 Medium EPSS 12.1% KEV · Not listed
Vendors
Fedoraproject Php Redhat
Products
Fedora Php Enterprise Linux
CVE-2024-11236

Integer overflow in the firebird and dblib quoters causing OOB writes

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed
Vendors
Php Php Group
Products
Php Php
CVE-2024-11234

Configuring a proxy in a stream context might allow for CRLF injection in URIs

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.

CVSS 3.1 · 4.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Php Php Group Redhat
Products
Php Php Enterprise Linux
CVE-2024-11233

Single byte overread with convert.quoted-printable-decode filter

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.

CVSS 3.1 · 4.8 Medium EPSS 1.6% KEV · Not listed
Vendors
Php Php Group Redhat
Products
Php Php Enterprise Linux
CVE-2022-4900

Potential buffer overflow in php_cli_server_startup_workers

A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux Rhel Software Collections and 1 more
CVE-2025-1861

Stream HTTP wrapper truncates redirect location to 1024 bytes

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Php Redhat
Products
Ontap Php Enterprise Linux
CVE-2025-1736

Stream HTTP wrapper header check might omit basic auth header

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Php Redhat
Products
Ontap Php Enterprise Linux
CVE-2025-1734

Streams HTTP wrapper does not fail for headers with invalid name and no colon

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Php Redhat
Products
Ontap Php Enterprise Linux
CVE-2025-1219

libxml streams use wrong content-type header when requesting a redirected resource

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Php Redhat
Products
Php Enterprise Linux