PHP

CVEs (731)

• CVE-2006-1494Apr 10, 2006
  PHP

  PHP
  risk 0.03cvss —epss 0.06

  Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.

• CVE-2006-1014Mar 7, 2006
  PHP

  PHP
  risk 0.03cvss —epss 0.01

  Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mb_send_mail function, allows context-dependent attackers to read and create arbitrary files by…

• CVE-2002-2309Dec 31, 2002
  PHP

  PHP
  risk 0.03cvss —epss 0.04

  php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.

• CVE-2015-4026Jun 9, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.20

  The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a…

• CVE-2015-4025Jun 9, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.20

  PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a…

• CVE-2015-4022Jun 9, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.21

  Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.

• CVE-2015-4021Jun 9, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.21

  The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer…

• CVE-2015-2331Mar 30, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.28

  Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application…

• CVE-2014-9705Mar 30, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.19

  Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

• CVE-2014-3670Oct 29, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.23

  The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application…

• CVE-2014-3669Oct 29, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.29

  Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the…

• CVE-2014-3668Oct 29, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.27

  Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a…

• CVE-2014-3515Jul 9, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.30

  The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable…

• CVE-2014-2497Mar 21, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.22

  The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.

• CVE-2006-0200Jan 13, 2006
  PHP

  PHP
  risk 0.02cvss —epss 0.19

  Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.

• CVE-2004-0542Aug 6, 2004
  PHP

  PHP
  risk 0.02cvss —epss 0.31

  PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd…

• CVE-2002-0081Mar 8, 2002
  PHP

  PHP
  risk 0.02cvss —epss 0.24

  Buffer overflows in (1) php_mime_split in PHP 4.1.0, 4.1.1, and 4.0.6 and earlier, and (2) php3_mime_split in PHP 3.0.x allows remote attackers to execute arbitrary code via a multipart/form-data HTTP POST request when file_uploads is enabled.

• CVE-2015-7804Dec 11, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.09

  Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.

• CVE-2015-7803Dec 11, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.10

  The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator…

• CVE-2015-4147Jun 9, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.12

  The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected…