Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-42471

Client‑side Remote Code Execution via Unsafe Deserialization in MixPHP Framework Sync‑Invoke

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client (Connection.php:76) calls unserialize() on data received from the server response, enabling client-side RCE if connecting to a malicious server.

CVSS 3.1 · 8.1 High EPSS 1.8% KEV · Not listed
Vendors
Mix-php
Products
Mix
CVE-2026-42472

Serialization Vulnerability in MixPHP Framework Causing Potential Remote Code Execution

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from Redis in the RedisHandler object.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mix-php
Products
Mix
CVE-2026-42473

Unsafe Deserialization Resulting in Remote Code Execution in MixPHP Framework

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mix-php
Products
Mix
CVE-2026-42474

SQL Injection in MixPHP BuildHelper Data Function

SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `data` array to the data function in BuildHelper.php.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mix-php
Products
Mix
CVE-2026-42475

SQL Injection in MixPHP Framework BuildHelper joinOn Function

SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `on` array to the joinOn function in BuildHelper.php.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mix-php Openmix
Products
Mix Mix Php
CVE-2026-37552

Unsafe Deserialization in MixPHP Framework 2.x Allows Arbitrary Code Execution via TCP

Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke TCP server (Server.php:87) receives data from a TCP socket, passes it directly to Opis\Closure\unserialize(), then executes the result via call_user_func(). No authentication or signature verification exists on the TCP connection. An attacker with access to the localhost TCP port (server binds 127.0.0.1) can send a crafted serialized PHP closure to achieve arbitrary code execution.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Mix-php Openmix
Products
Mix Mix Php