VYPR
← PHP

Vendor CVEs

PHP

All CVEs

764 total · sorted by risk
  • CVE-2002-0081Mar 8, 2002
    PHP
    PHP
    risk 0.02cvss —epss 0.24

    Buffer overflows in (1) php_mime_split in PHP 4.1.0, 4.1.1, and 4.0.6 and earlier, and (2) php3_mime_split in PHP 3.0.x allows remote attackers to execute arbitrary code via a multipart/form-data HTTP POST request when file_uploads is enabled.

  • CVE-2015-7804Dec 11, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.09

    Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (uninitialized pointer dereference and application crash) by including the / filename in a .zip PHAR archive.

  • CVE-2015-7803Dec 11, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.10

    The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a .phar file with a crafted TAR archive entry in which the Link indicator…

  • CVE-2015-4147Jun 9, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.12

    The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected…

  • CVE-2015-3330Jun 9, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.14

    The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary…

  • CVE-2015-3307Jun 9, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.08

    The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

  • CVE-2015-2783Jun 9, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.11

    ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with…

  • CVE-2015-2787Mar 30, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.12

    Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset…

  • CVE-2015-2348Mar 30, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.09

    The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create…

  • CVE-2015-2305Mar 30, 2015
    Henry Spencer
    rxspencer
    risk 0.01cvss —epss 0.08

    Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular…

  • CVE-2015-2301Mar 30, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.15

    Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar…

  • CVE-2015-1352Mar 30, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.08

    The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for table names, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted name.

  • CVE-2015-1351Mar 30, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.09

    Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

  • CVE-2014-9709Mar 30, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.16

    The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the…

  • CVE-2015-0232Jan 27, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.15

    The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free and application crash) via crafted EXIF data in a…

  • CVE-2014-9427Jan 3, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.17

    sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a .php file, does not properly consider the mapping's length during processing of an invalid file that begins with a # character and lacks a…

  • CVE-2014-5120Aug 23, 2014
    PHP
    PHP
    risk 0.01cvss —epss 0.17

    gd_ctx.c in the GD component in PHP 5.4.x before 5.4.32 and 5.5.x before 5.5.16 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to overwrite arbitrary files via crafted input to an application that calls the (1) imagegd, (2) imagegd2, (3)…

  • CVE-2013-2110Jun 21, 2013
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted argument to…

  • CVE-2013-1643Mar 6, 2013
    PHP
    PHP
    risk 0.01cvss —epss 0.10

    The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the…

  • CVE-2013-1635Mar 6, 2013
    PHP
    PHP
    risk 0.01cvss —epss 0.10

    ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached…

  • CVE-2012-2688Jul 20, 2012
    PHP
    PHP
    risk 0.01cvss —epss 0.10

    Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."

  • CVE-2012-1172May 24, 2012
    PHP
    PHP
    risk 0.01cvss —epss 0.06

    The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal…

  • CVE-2012-0831Feb 10, 2012
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c,…

  • CVE-2011-4566Nov 29, 2011
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-bit platforms allows remote attackers to read the contents of arbitrary memory locations or cause a denial of service via a crafted offset_val value in an EXIF header in…

  • CVE-2011-1153Mar 16, 2011
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via…

  • CVE-2010-3436Nov 9, 2010
    PHP
    PHP
    risk 0.01cvss —epss 0.06

    fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions via vectors related to the length of a filename.

  • CVE-2009-3546Oct 19, 2009
    PHP
    PHP
    risk 0.01cvss —epss 0.10

    The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD…

  • CVE-2008-5557Dec 23, 2008
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during…

  • CVE-2008-3658Aug 15, 2008
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5.2.6-r6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.

  • CVE-2008-2371Jul 7, 2008
    Pcre
    Pcre
    risk 0.01cvss —epss 0.07

    Heap-based buffer overflow in pcre_compile.c in the Perl-Compatible Regular Expression (PCRE) library 7.7 allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a regular expression that begins with an option and contains…

  • CVE-2007-0455Jan 30, 2007
    Libgd
    GD Graphics Library
    risk 0.01cvss —epss 0.12

    Buffer overflow in the gdImageStringFTEx function in gdft.c in GD Graphics Library 2.0.33 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted string with a JIS encoded font.

  • CVE-2006-5465Nov 4, 2006
    PHP
    PHP
    risk 0.01cvss —epss 0.08

    Buffer overflow in PHP before 5.2.0 allows remote attackers to execute arbitrary code via crafted UTF-8 inputs to the (1) htmlentities or (2) htmlspecialchars functions.

  • CVE-2006-4484Aug 31, 2006
    PHP
    PHP
    risk 0.01cvss —epss 0.06

    Buffer overflow in the LWZReadByte_ function in ext/gd/libgd/gd_gif_in.c in the GD extension in PHP before 5.1.5 allows remote attackers to have an unknown impact via a GIF file with input_code_size greater than MAX_LWZ_BITS, which triggers an overflow when initializing the…

  • CVE-2006-1990Apr 24, 2006
    PHP
    PHP
    risk 0.01cvss —epss 0.10

    Integer overflow in the wordwrap function in string.c in PHP 4.4.2 and 5.1.2 might allow context-dependent attackers to execute arbitrary code via certain long arguments that cause a small buffer to be allocated, which triggers a heap-based buffer overflow in a memcpy function…

  • CVE-2005-4154Dec 11, 2005
    Pear
    PEAR Installer
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in PEAR installer 1.4.2 and earlier allows user-assisted attackers to execute arbitrary code via a crafted package that can execute code when the pear command is executed or when the Web/Gtk frontend is loaded.

  • CVE-2005-3353Nov 18, 2005
    PHP
    PHP
    risk 0.01cvss —epss 0.08

    The exif_read_data function in the Exif module in PHP before 4.4.1 allows remote attackers to cause a denial of service (infinite loop) via a malformed JPEG image.

  • CVE-2005-3389Nov 1, 2005
    PHP
    PHP
    risk 0.01cvss —epss 0.06

    The parse_str function in PHP 4.x up to 4.4.0 and 5.x up to 5.0.5, when called with only one parameter, allows remote attackers to enable the register_globals directive via inputs that cause a request to be terminated due to the memory_limit setting, which causes PHP to set an…

  • CVE-2005-3392Nov 1, 2005
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Unspecified vulnerability in PHP before 4.4.1, when using the virtual function on Apache 2, allows remote attackers to bypass safe_mode and open_basedir directives.

  • CVE-2005-3391Nov 1, 2005
    PHP
    PHP
    risk 0.01cvss —epss 0.07

    Multiple vulnerabilities in PHP before 4.4.1 allow remote attackers to bypass safe_mode and open_basedir restrictions via unknown attack vectors in (1) ext/curl and (2) ext/gd.

  • CVE-2004-1065Jan 10, 2005
    PHP
    PHP
    risk 0.01cvss —epss 0.10

    Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.

  • CVE-2004-1019Jan 10, 2005
    PHP
    PHP
    risk 0.01cvss —epss 0.08

    The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index…

  • CVE-2003-1303Dec 31, 2003
    PHP
    PHP
    risk 0.01cvss —epss 0.12

    Buffer overflow in the imap_fetch_overview function in the IMAP functionality (php_imap.c) in PHP before 4.3.3 allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long e-mail address in a (1) To or (2) From header.

  • CVE-2002-1783Dec 31, 2002
    PHP
    PHP
    risk 0.01cvss —epss 0.17

    CRLF injection vulnerability in PHP 4.2.1 through 4.2.3, when allow_url_fopen is enabled, allows remote attackers to modify HTTP headers for outgoing requests by causing CRLF sequences to be injected into arguments that are passed to the (1) fopen or (2) file functions.

  • CVE-2002-0717Jul 26, 2002
    PHP
    PHP
    risk 0.01cvss —epss 0.11

    PHP 4.2.0 and 4.2.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via an HTTP POST request with certain arguments in a multipart/form-data form, which generates an error condition that is not properly handled and causes improper memory…

  • CVE-2002-0240May 29, 2002
    PHP
    PHP
    risk 0.01cvss —epss 0.08

    PHP, when installed with Apache and configured to search for index.php as a default web page, allows remote attackers to obtain the full pathname of the server via the HTTP OPTIONS method, which reveals the pathname in the resulting error message.

  • CVE-2002-0249May 29, 2002
    PHP
    PHP
    risk 0.01cvss —epss 0.08

    PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the php.exe via a request with malformed arguments such as /123, which leaks the pathname in the error message.

  • CVE-2001-1247Dec 6, 2001
    PHP
    PHP
    risk 0.01cvss —epss 0.09

    PHP 4.0.4pl1 and 4.0.5 in safe mode allows remote attackers to read and write files owned by the web server UID by uploading a PHP script that uses the error_log function to access the files.

  • CVE-2026-24895Feb 12, 2026
    PHP
    Frankenphp
    risk 0.00cvss —epss 0.01

    FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request path but applies…

  • CVE-2026-24894Feb 12, 2026
    PHP
    Frankenphp
    risk 0.00cvss —epss 0.00

    FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION data of the…

  • CVE-2025-14177Dec 27, 2025
    PHP
    PHP
    risk 0.00cvss —epss 0.00

    In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via…

Page 10 of 16