PHP

CVEs (751)

• CVE-2006-0200Jan 13, 2006
  PHP

  PHP
  risk 0.02cvss —epss 0.19

  Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.

• CVE-2004-0542Aug 6, 2004
  PHP

  PHP
  risk 0.02cvss —epss 0.31

  PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd…

• CVE-2002-0081Mar 8, 2002
  PHP

  PHP
  risk 0.02cvss —epss 0.24

  Buffer overflows in (1) php_mime_split in PHP 4.1.0, 4.1.1, and 4.0.6 and earlier, and (2) php3_mime_split in PHP 3.0.x allows remote attackers to execute arbitrary code via a multipart/form-data HTTP POST request when file_uploads is enabled.

• CVE-2015-7804Dec 11, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.09

  Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.

• CVE-2015-7803Dec 11, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.10

  The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator…

• CVE-2015-4147Jun 9, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.12

  The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected…

• CVE-2015-3330Jun 9, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.14

  The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary…

• CVE-2015-3307Jun 9, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.08

  The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

• CVE-2015-2783Jun 9, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.11

  ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with…

• CVE-2015-2787Mar 30, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.12

  Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset…

• CVE-2015-2348Mar 30, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.09

  The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create…

• CVE-2015-2305Mar 30, 2015
  Henry Spencer

  rxspencer
  risk 0.01cvss —epss 0.08

  Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular…

• CVE-2015-2301Mar 30, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.15

  Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar…

• CVE-2015-1352Mar 30, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.08

  The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.

• CVE-2015-1351Mar 30, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.09

  Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

• CVE-2014-9709Mar 30, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.15

  The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the…

• CVE-2015-0232Jan 27, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.16

  The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a…

• CVE-2014-9427Jan 3, 2015
  PHP

  PHP
  risk 0.01cvss —epss 0.17

  sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a…

• CVE-2014-5120Aug 23, 2014
  PHP

  PHP
  risk 0.01cvss —epss 0.17

  gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3)…

• CVE-2013-2110Jun 21, 2013
  PHP

  PHP
  risk 0.01cvss —epss 0.07

  Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted argument to…