110640 matches found
PT-2026-84455
Name of the Vulnerable Software and Affected Versions phpseclib versions prior to 3.0.57 phpseclib versions prior to 4.0.1 Description Pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in the add and subtract...
ROS-20260901-73-0013
The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...
PT-2026-84465
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payloa...
CVE-2026-71981: Deserialization of Untrusted Data
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...
ALSA-2026:61903 Important: php:8.2 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...
ALSA-2026:62334 Important: php:7.4 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...
CVE-2026-84192: Improper Neutralization of Input During Web Page Generation
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...
CVE-2026-84193: Improper Neutralization of Input During Web Page Generation
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...
PHP mb_* Functions
The vulnerability of the functions mbconvertencoding, mbdetectencoding, mbconvertvariables, and mbdetectorder in the PHP interpreter is related to reading beyond the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to cause an unexpected termination of the application...
RHEL 9 : php:8.2 (RHSA-2026:61903)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61903 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection vi...
ROS-20260901-73-0009
The vulnerability in PHP is related to the assignment of a null pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...
PT-2026-84156
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...
SPIP 4.4.8 Insecure Deserialization
SPIP versions 4.4.0 through 4.4.8 contain an insecure deserialization vulnerability in the public area through the tablevaleur filter and DATA iterator. An attacker able to place malicious serialized content can trigger arbitrary object instantiation and potentially achieve remote code execution...
ROS-20260901-73-0015
The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...
ROS-20260901-73-0004
The vulnerability of the urldecode function in the PHP programming language is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
ROS-20260901-73-0003
The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service...
ROS-20260901-73-0010
The vulnerability of the PDO driver for the Firebird database management system, which is written in the PHP programming language, relates to the lack of protective measures taken against the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute SQL injections...
ROS-20260901-73-0001
The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service...
ROS-20260901-73-0026
The vulnerability in php-phpseclib is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks remotely...
ROS-20260901-73-0002
The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service...