PHP

CVEs (731)

• CVE-2021-21707MedNov 29, 2021
  PHP

  PHP
  risk 0.37cvss 5.3epss 0.26

  In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as…

• CVE-2018-5711MedJan 16, 2018
  PHP

  PHP
  risk 0.37cvss 5.5epss 0.13

  gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1, has an integer signedness error that leads to an infinite loop via a crafted GIF file, as demonstrated by a call to the…

• CVE-2014-0207MedJul 9, 2014
  PHP

  PHP
  risk 0.37cvss 6.5epss 0.17

  The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.

• CVE-2020-7063MedFeb 27, 2020
  PHP

  PHP
  risk 0.36cvss 5.5epss 0.02

  In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator() function, the files are added with default permissions (0666, or all access) even if the original files on the filesystem were with more…

• CVE-2015-9253MedFeb 19, 2018
  PHP

  PHP
  risk 0.36cvss 6.5epss 0.04

  An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN…

• CVE-2014-3480MedJul 9, 2014
  PHP

  PHP
  risk 0.36cvss 6.5epss 0.11

  The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted…

• CVE-2014-3478MedJul 9, 2014
  PHP

  PHP
  risk 0.36cvss 6.5epss 0.15

  Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING…

• CVE-2026-7259MedMay 10, 2026
  PHP

  PHP
  risk 0.35cvss 6.5epss 0.00

  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to  a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is…

• CVE-2021-21706MedOct 4, 2021
  PHP

  ZipArchive
  risk 0.35cvss 5.3epss 0.01

  In PHP versions 7.3.x below 7.3.31, 7.4.x below 7.4.24 and 8.0.x below 8.0.11, in Microsoft Windows environment, ZipArchive::extractTo may be tricked into writing a file outside target directory when extracting a ZIP file, thus potentially causing files to be created or…

• CVE-2021-21702MedFeb 15, 2021
  PHP

  PHP
  risk 0.35cvss 5.3epss 0.03

  In PHP versions 7.3.x below 7.3.27, 7.4.x below 7.4.15 and 8.0.x below 8.0.2, when using SOAP extension to connect to a SOAP server, a malicious SOAP server could return malformed XML data as a response that would cause PHP to access a null pointer and thus cause a crash.

• CVE-2020-7071MedFeb 15, 2021
  PHP

  PHP
  risk 0.35cvss 5.3epss 0.03

  In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the…

• CVE-2021-26938MedFeb 10, 2021
  PHP

  PHP
  risk 0.35cvss 5.4epss 0.01

  A stored XSS issue exists in henriquedornas 5.2.17 via online live chat. NOTE: Third parties report that no such product exists. That henriquedornas is the web design agency and 5.2.17 is simply the PHP version running on this hosts

• CVE-2020-7069MedOct 2, 2020
  PHP

  PHP
  risk 0.35cvss 5.4epss 0.02

  In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is actually used. This can lead to both decreased security and incorrect encryption data.

• CVE-2019-11048MedMay 20, 2020
  PHP

  PHP
  risk 0.35cvss 5.3epss 0.06

  In PHP versions 7.2.x below 7.2.31, 7.3.x below 7.3.18 and 7.4.x below 7.4.6, when HTTP file uploads are allowed, supplying overly long filenames or field names could lead PHP engine to try to allocate oversized memory storage, hit the memory limit and stop processing the…

• CVE-2020-7066MedApr 1, 2020
  PHP

  PHP
  risk 0.35cvss 5.3epss 0.03

  In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using get_headers() with user-supplied URL, if the URL contains zero (\0) character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the…

• CVE-2019-11038MedJun 19, 2019
  PHP

  PHP
  risk 0.35cvss 5.3epss 0.04

  When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30, 7.2.x below 7.2.19 and 7.3.x below 7.3.6, it is possible to supply data that will cause the function to use the value…

• CVE-2016-7128MedSep 12, 2016
  PHP

  PHP
  risk 0.35cvss 5.3epss 0.08

  The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles the case of a thumbnail offset that exceeds the file size, which allows remote attackers to obtain sensitive information from process memory via a crafted TIFF image.

• CVE-2015-3412MedMay 16, 2016
  PHP

  PHP
  risk 0.35cvss 5.3epss 0.04

  PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in…

• CVE-2026-6735MedMay 10, 2026
  PHP

  PHP
  risk 0.33cvss 6.1epss 0.00

  In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine…

• CVE-2021-21704MedOct 4, 2021
  PHP

  PHP
  risk 0.33cvss 5.0epss 0.02

  In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using Firebird PDO driver extension, a malicious database server could cause crashes in various database functions, such as getAttribute(), execute(), fetch() and others by returning invalid…