prod
Unable to find the service "/PHP" to search know vulnerability.
This service has potential vendor: php/php
Unable to find the service "/WordPress" to search know vulnerability.
This service has potential vendor: wordpress/wordpress
WordPress 6.5.3
64 vulnerabilities has been found
0 abandonned packages has been found
Last analyse : 13 hours ago
64
Vulnerabilities
3 affected packages
- Critical 11
- High 19
- Medium 29
- Low 5
- Unrated 0
-
/php
58
-
/wordpress
3
-
Mariadb/mariadb
3
58
/php
Vulnerabilities
- Critical 11
- High 17
- Medium 25
- Low 5
- Unrated 0
58
/PHP
8.2
-
Critical CVE-2022-31631 Reported 2/12/25In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.
References
-
Critical CVE-2023-3824 Reported 8/11/23In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.
References
-
Critical CVE-2024-11236 Reported 11/24/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
References
-
Critical CVE-2024-1874 Reported 4/29/24In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
References
- www.openwall.com /lists/oss-security/2024/04/12/11
- www.openwall.com /lists/oss-security/2024/06/07/1
- github.com /php/php-src/security/advisories/GHSA-pc52-254m-w9w7
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
- security.netapp.com /advisory/ntap-20240510-0009/
- www.vicarius.io /vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585
-
Critical CVE-2024-3566 Reported 4/10/24A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
References
- flatt.tech /research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
- kb.cert.org /vuls/id/123335
- learn.microsoft.com /en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way
- www.cve.org /CVERecord?id=CVE-2024-1874
- www.cve.org /CVERecord?id=CVE-2024-22423
- www.cve.org /CVERecord?id=CVE-2024-24576
- www.kb.cert.org /vuls/id/123335
-
Critical CVE-2024-4577 Reported 6/9/24In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
References
- github.com /php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv
- blog.orange.tw /2024/06/cve-2024-4577-yet-another-php-rce.html
- devco.re /blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
- arstechnica.com /security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/
- www.imperva.com /blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/
- github.com /11whoami99/CVE-2024-4577
- github.com /xcanwin/CVE-2024-4577-PHP-RCE
- github.com /rapid7/metasploit-framework/pull/19247
- labs.watchtowr.com /no-way-php-strikes-again-cve-2024-4577/
- github.com /watchtowrlabs/CVE-2024-4577
- www.php.net /ChangeLog-8.php#8.1.29
- www.php.net /ChangeLog-8.php#8.2.20
- www.php.net /ChangeLog-8.php#8.3.8
- cert.be /en/advisory/warning-php-remote-code-execution-patch-immediately
- isc.sans.edu /diary/30994
- www.openwall.com /lists/oss-security/2024/06/07/1
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
- security.netapp.com /advisory/ntap-20240621-0008/
-
Critical CVE-2024-8932 Reported 11/22/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
References
-
Critical CVE-2025-1861 Reported 3/30/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
References
-
Critical CVE-2026-109618 Reported 10/21/26PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).
References
-
Critical CVE-2026-109619 Reported 10/21/26PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).
References
- github.com /php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- www.openwall.com /lists/oss-security/2026/10/21/16
- www.openwall.com /lists/oss-security/2026/10/21/17
- www.openwall.com /lists/oss-security/2026/10/21/23
- www.openwall.com /lists/oss-security/2026/10/21/7
- www.openwall.com /lists/oss-security/2026/10/22/14
- www.openwall.com /lists/oss-security/2026/10/22/15
- www.openwall.com /lists/oss-security/2026/10/22/16
- www.openwall.com /lists/oss-security/2026/10/22/19
- www.openwall.com /lists/oss-security/2026/10/22/2
- www.openwall.com /lists/oss-security/2026/10/22/20
- www.openwall.com /lists/oss-security/2026/10/23/4
- cert-portal.siemens.com /productcert/html/ssa-566512.html
- www.wiz.io /blog/php2shell-php-rce
-
Critical CVE-2026-6722 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
References
-
High CVE-2023-0568 Reported 2/16/23In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being overwritten with NUL value, which might lead to unauthorized data access or modification.
References
-
High CVE-2023-0662 Reported 2/16/23In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space.
References
-
High CVE-2023-3823 Reported 8/11/23In PHP versions 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8 various XML functions rely on libxml global state to track configuration variables, like whether external entities are loaded. This state is assumed to be unchanged unless the user explicitly changes it by calling appropriate function. However, since the state is process-global, other modules - such as ImageMagick - may also use this library within the same process, and change that global state for their internal purposes, and leave it in a state where external entities loading is enabled. This can lead to the situation where external XML is parsed with external entities loaded, which can lead to disclosure of any local files accessible to PHP. This vulnerable state may persist in the same process across many requests, until the process is shut down.
References
-
High CVE-2024-11233 Reported 11/24/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.
References
-
High CVE-2024-11234 Reported 11/24/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
References
-
High CVE-2024-5585 Reported 6/9/24In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
References
- github.com /php/php-src/security/advisories/GHSA-9fcc-425m-g385
- www.openwall.com /lists/oss-security/2024/06/07/1
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
-
High CVE-2024-8926 Reported 10/8/24In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
References
-
High CVE-2024-8927 Reported 10/8/24In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
References
-
High CVE-2025-14177 Reported 12/27/25In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
References
-
High CVE-2025-14178 Reported 12/27/25In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
References
-
High CVE-2025-14179 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
References
-
High CVE-2025-14180 Reported 12/27/25In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
References
-
High CVE-2025-1735 Reported 7/13/25In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
References
-
High CVE-2025-1736 Reported 3/30/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
References
-
High CVE-2026-17543 Reported 7/30/26Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
- Affected versions
8.2.0 - 8.2.32 || 8.3.0 - 8.3.32 || 8.4.0 - 8.4.23 || 8.5.0 - 8.5.8- Patched versions
8.2.33,8.3.33,8.4.24,8.5.9
References
-
High CVE-2026-6735 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
References
-
High CVE-2026-91765 Reported 9/25/26cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exists in the SOAP value decoder and in the WSDL node search helper.
References
-
Medium CVE-2023-0567 Reported 3/1/23In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.
References
-
Medium CVE-2023-3247 Reported 7/22/23In PHP versions 8.0.* before 8.0.29, 8.1.* before 8.1.20, 8.2.* before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure of 31 bits of uninitialized memory from the client to the server, and it also made easier to a malicious server to guess the client's nonce.
References
-
Medium CVE-2024-2408 Reported 6/9/24The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.
References
- github.com /php/php-src/security/advisories/GHSA-hh26-4ppw-5864
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
-
Medium CVE-2024-3096 Reported 4/29/24In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
References
-
Medium CVE-2024-5458 Reported 6/9/24In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
References
- github.com /php/php-src/security/advisories/GHSA-w8qr-v226-r27w
- www.openwall.com /lists/oss-security/2024/06/07/1
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
- lists.debian.org /debian-lts-announce/2024/06/msg00009.html
-
Medium CVE-2024-8925 Reported 10/8/24In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.
References
-
Medium CVE-2024-8929 Reported 11/22/24In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
References
-
Medium CVE-2025-1219 Reported 3/30/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
- Affected versions
>=8.1.0 <=8.1.31 || >=8.2.0 <=8.2.27 || >=8.3.0 <=8.3.18 || >=8.4.0 <=8.4.4
References
-
Medium CVE-2025-1220 Reported 7/13/25In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parse_url() treat the hostname in different way, thus opening way to security problems if the user code implements access checks before access using such functions.
References
-
Medium CVE-2025-14181 Reported 9/25/26The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
References
-
Medium CVE-2025-1734 Reported 3/30/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.
References
-
Medium CVE-2025-6491 Reported 7/13/25In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server.
References
-
Medium CVE-2026-14355 Reported 7/3/26In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
References
-
Medium CVE-2026-17545 Reported 9/25/26On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
References
-
Medium CVE-2026-6103 Reported 9/25/26phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.
References
-
Medium CVE-2026-7258 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
References
-
Medium CVE-2026-7260 Reported 7/30/26Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
References
-
Medium CVE-2026-7261 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
References
-
Medium CVE-2026-7568 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
References
-
Medium CVE-2026-91766 Reported 9/25/26When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP. A server that can steer a redirect therefore receives credentials that were only meant for the original origin. This is the same class of issue that libcurl fixed in 7.58.0 ( CVE-2018-1000007 https://github.com/advisories/GHSA-g7x2-hrfp-pv5f ).
References
-
Medium CVE-2026-91767 Reported 9/25/26php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP client read up to SIZE_MAX bytes past the end of a heap allocation. The path is reachable from any default client stream, because verify_peer_name is enabled by default.
References
-
Medium CVE-2026-91768 Reported 9/25/26The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and reaches the FastCGI endpoint.
References
-
Medium CVE-2026-91769 Reported 9/25/26PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
References
-
Medium CVE-2026-92842 Reported 9/25/26The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup(), which stops at the first NUL byte, while keeping the original length. When the filter later emits a line break it copies the recorded length out of the truncated allocation, reading past its end and placing adjacent heap bytes into the filter output.
References
-
Medium CVE-2026-93682 Reported 9/25/26When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server controls whether the client is sent to the host root or to the current directory.
References
-
Low CVE-2024-9026 Reported 10/8/24In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
References
-
Low CVE-2025-1217 Reported 3/29/25In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.
- Affected versions
>=8.1.0 <=8.1.31 || >=8.2.0 <=8.2.27 || >=8.3.0 <=8.3.18 || >=8.4.0 <=8.4.4
References
-
Low CVE-2025-1218 Reported 9/25/26The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
References
-
Low CVE-2026-7259 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
References
-
Low CVE-2026-7262 Reported 5/10/26In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
References
3
/wordpress
Vulnerabilities
- Critical 0
- High 2
- Medium 1
- Low 0
- Unrated 0
3
/WordPress
6.5.3
-
High CVE-2026-119977 Reported 10/31/26WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
References
- core.trac.wordpress.org /browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
- core.trac.wordpress.org /browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
- core.trac.wordpress.org /browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
- core.trac.wordpress.org /browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
- core.trac.wordpress.org /browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
- core.trac.wordpress.org /browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
- wordpress.org /news/2026/10/wordpress-7-1-4/
- www.wordfence.com /threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
- www.cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-119977
- www.wordfence.com /threat-intel/vulnerabilities/wordpress-core/wordpress-core-470-713-unauthenticated-upgrade-window-staged-installer-remote-code-execution
-
High CVE-2026-87902 Reported 9/22/26An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
References
-
Medium CVE-2007-2627 Reported 5/11/07Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are used, allows remote attackers to inject arbitrary web script or HTML via the query string (PHP_SELF), a different vulnerability than CVE-2007-1622.
References
3
Mariadb/mariadb
Vulnerabilities
- Critical 0
- High 0
- Medium 3
- Low 0
- Unrated 0
3
mariadb/mariadb
10.11
-
Medium CVE-2022-47015 Reported 1/20/23MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.
References
- github.com /MariaDB/server/commit/be0a46b3d52b58956fd0d47d040b9f4514406954
- security.netapp.com /advisory/ntap-20230309-0009/
- lists.debian.org /debian-lts-announce/2023/06/msg00005.html
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/O22PO3Q6TRSNJI2A2WTJH3VVCHEKBF6C/
- lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/SUQ33SPQCZQD63TWAM3XKFNVNFRGPFYU/
-
Medium CVE-2023-22084 Reported 10/17/23Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.43 and prior, 8.0.34 and prior and 8.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).
References
- lists.debian.org /debian-lts-announce/2024/01/msg00017.html
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/OR7GNQAJZ7NMHT4HRDNROR3DS272KKET/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/UCGSAQFWYIJRIYLZLHPS3MRUS4AQ5JQH/
- lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/YZL2AT2ZUKB6K22UTISHEZ4JKG4VZ3VO/
- security.netapp.com /advisory/ntap-20231027-0009/
- www.oracle.com /security-alerts/cpuoct2023.html
-
Medium CVE-2026-3494 Reported 3/3/26In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged.
References
Your version is Php 8.0
End of life
Your version is Mariadb 10.11
Maintained version
Your version is Wordpress 6.5
Maintained version
Your version is Nginx 1.23
End of life
Current vulnerabilities
64
Last change
-1
Nov 8, 2026
Abandoned packages
0
Analyses with changes
38
Vulnerabilities by severity
Changes between analyses
Latest changes
-
Nov 8, 2026, 2:17 AM−1 closed64 total
-
Nov 7, 2026, 2:06 AM+1 new65 total
-
Nov 1, 2026, 2:03 AM+5 new64 total
-
Oct 26, 2026, 2:03 AM+8 new59 total
-
Oct 23, 2026, 3:03 AM+1 new51 total
-
Oct 1, 2026, 4:08 PM+50 new50 total
-
Sep 24, 2026, 3:02 AM−50 closed0 total
-
Aug 7, 2026, 3:03 AM+2 new50 total
-
Jul 10, 2026, 3:01 AM+1 new48 total
-
Jul 7, 2026, 3:02 AM+47 new47 total
-
Jul 1, 2026, 3:05 AM−47 closed0 total
-
Jun 4, 2026, 3:02 AM+1 new47 total
-
May 14, 2026, 3:02 AM+8 new46 total
-
Mar 11, 2026, 2:03 AM+1 new38 total
-
Jan 11, 2026, 2:03 AM+2 new37 total
-
Jan 10, 2026, 2:03 AM+1 new35 total
-
Dec 10, 2025, 2:04 AM+34 new34 total
-
Dec 9, 2025, 2:03 AM−34 closed0 total
-
Oct 8, 2025, 3:03 AM−1 closed34 total
-
Aug 21, 2025, 3:03 AM+4 new35 total
-
Aug 7, 2025, 3:03 AM+31 new31 total
-
Aug 6, 2025, 3:04 AM−31 closed0 total
-
Aug 5, 2025, 3:03 AM+31 new31 total
-
Jul 31, 2025, 3:05 AM−31 closed0 total
-
Jul 24, 2025, 3:03 AM+3 new31 total
-
Jul 7, 2025, 3:03 AM+6 new28 total
-
Jun 20, 2025, 3:01 AM+2 new22 total
-
Jun 19, 2025, 3:01 AM+1 new20 total
-
May 3, 2025, 3:01 AM+1 new19 total
-
Apr 17, 2025, 3:01 AM+1 new18 total
-
Feb 28, 2025, 2:01 AM+17 new17 total
-
Feb 21, 2025, 3:28 AM−17 closed0 total
-
Jan 24, 2025, 2:01 AM+1 new17 total
-
Nov 28, 2024, 2:01 AM+3 new16 total
-
Nov 9, 2024, 2:01 AM+13 new13 total
-
Jul 24, 2024, 3:24 AM−13 closed0 total
-
Jul 12, 2024, 5:14 PM+1 new13 total
-
Jul 12, 2024, 8:51 AM+12 new12 total
Badges
[](https://audit.security.code-rhapsodie.fr/en/project/018f807a-495f-7f48-8bc2-2347e7f6ad76)
[](https://audit.security.code-rhapsodie.fr/en/project/018f807a-495f-7f48-8bc2-2347e7f6ad76)
[](https://audit.security.code-rhapsodie.fr/en/project/018f807a-495f-7f48-8bc2-2347e7f6ad76)
[](https://audit.security.code-rhapsodie.fr/en/project/018f807a-495f-7f48-8bc2-2347e7f6ad76)