PHP

CVEs (751)

• CVE-2006-4020Aug 8, 2006
  PHP

  PHP
  risk 0.03cvss —epss 0.02

  scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.

• CVE-2006-3011Jun 26, 2006
  PHP

  PHP
  risk 0.03cvss —epss 0.01

  The error_log function in basic_functions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and open_basedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode.

• CVE-2006-1549Apr 10, 2006
  PHP

  PHP
  risk 0.03cvss —epss 0.01

  PHP 4.4.2 and 5.1.2 allows local users to cause a crash (segmentation fault) by defining and executing a recursive function. NOTE: it has been reported by a reliable third party that some later versions are also affected.

• CVE-2006-1494Apr 10, 2006
  PHP

  PHP
  risk 0.03cvss —epss 0.06

  Directory traversal vulnerability in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass open_basedir restrictions allows remote attackers to create files in arbitrary directories via the tempnam function.

• CVE-2006-1608Apr 10, 2006
  PHP

  PHP
  risk 0.03cvss —epss 0.01

  The copy function in file.c in PHP 4.4.2 and 5.1.2 allows local users to bypass safe mode and read arbitrary files via a source argument containing a compress.zlib:// URI.

• CVE-2006-1014Mar 7, 2006
  PHP

  PHP
  risk 0.03cvss —epss 0.01

  Argument injection vulnerability in certain PHP 4.x and 5.x applications, when used with sendmail and when accepting remote input for the additional_parameters argument to the mb_send_mail function, allows context-dependent attackers to read and create arbitrary files by…

• CVE-2002-2309Dec 31, 2002
  PHP

  PHP
  risk 0.03cvss —epss 0.04

  php.exe in PHP 3.0 through 4.2.2, when running on Apache, does not terminate properly, which allows remote attackers to cause a denial of service via a direct request without arguments.

• CVE-2002-1954Dec 31, 2002
  PHP

  PHP
  risk 0.03cvss —epss 0.12

  Cross-site scripting (XSS) vulnerability in the phpinfo function in PHP 4.2.3 allows remote attackers to inject arbitrary web script or HTML via the query string argument, as demonstrated using soinfo.php.

• CVE-1999-0238Aug 1, 1997
  PHP

  PHP
  risk 0.03cvss —epss 0.06

  php.cgi allows attackers to read any file on the system.

• CVE-2015-4026Jun 9, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.20

  The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a…

• CVE-2015-4025Jun 9, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.20

  PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a…

• CVE-2015-4022Jun 9, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.21

  Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.

• CVE-2015-4021Jun 9, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.21

  The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer…

• CVE-2015-2331Mar 30, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.28

  Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 and other products, allows remote attackers to cause a denial of service (application…

• CVE-2014-9705Mar 30, 2015
  PHP

  PHP
  risk 0.02cvss —epss 0.19

  Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

• CVE-2014-3670Oct 29, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.23

  The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 operates on floating-point arrays incorrectly, which allows remote attackers to cause a denial of service (heap memory corruption and application…

• CVE-2014-3669Oct 29, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.29

  Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an argument to the…

• CVE-2014-3668Oct 29, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.27

  Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the XMLRPC extension in PHP before 5.4.34, 5.5.x before 5.5.18, and 5.6.x before 5.6.2 allows remote attackers to cause a denial of service (application crash) via (1) a…

• CVE-2014-3515Jul 9, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.30

  The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data structures will have the array data type after unserialization, which allows remote attackers to execute arbitrary code via a crafted string that triggers use of a Hashtable…

• CVE-2014-2497Mar 21, 2014
  PHP

  PHP
  risk 0.02cvss —epss 0.22

  The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.