VYPR
Get started
← All advisories
Medium severity6.1NVD Advisory· Published May 10, 2026· Updated May 12, 2026

CVE-2026-6735

CVE-2026-6735

Description

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.

Affected products

2
  • PHP/Php Srcinferred
    Range: >=8.2.0,<8.2.31, >=8.3.0,<8.3.31, >=8.4.0,<8.4.21, >=8.5.0,<8.5.6
  • PHP/PHP
    cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
    Range: >=8.2.0,<8.2.31

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

1