111235 matches found
php: ext/openssl: memory corruption in openssl_encrypt with AES-WRAP-PAD
A flaw was found in the OpenSSL extension of PHP. The AES-WRAP-PAD algorithm implementation uses the size of the plaintext length without accounting for the RFC 5649 expansion to allocate the output buffer for the AES key-wrap-with-padding operation. This may lead to an undersized memory allocati...
CVE-2026-82395: Authorization Bypass Through User-Controlled Key
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and...
CVE-2026-81890: Cross-Site Request Forgery (CSRF)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, the netmount command is omitted from elFinderConnector::$csrfProtectedCmds in php/elFinderConnector.class.php, so validateCsrfToken is not called for this state-changing operation. In the...
ROS-20260831-73-0006
The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
ROS-20260831-73-0004
The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
ROS-20260831-73-0005
The vulnerability of the soapaddxmlref function in the PHP programming language is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Amazon Linux 2 : gd, --advisory ALAS2-2026-3870 (ALAS-2026-3870)
The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3870 advisory. NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24DEBIANBUG: 1143152...
RockyLinux 9 : php (RLSA-2026:61259)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:61259 advisory. php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escapin...
RHEL 9 : php (RHSA-2026:61259)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61259 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption i...
ROS-20260831-73-0014
The vulnerability of the metaphone function ext/standard/metaphone.c in the PHP programming language is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to trigger segmentation errors and cause service failures...
ROS-20260831-73-0015
The vulnerability of the metaphone function ext/standard/metaphone.c in the PHP programming language is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to trigger segmentation errors and cause service failures...
ROS-20260831-73-0016
The vulnerability of the metaphone function ext/standard/metaphone.c in the PHP programming language is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to trigger segmentation errors and cause service failures...
CVE-2026-66047: Missing Authentication for Critical Function
ProfilePress wp-user-avatar WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppressconnectprocess AJAX handler...
CVE-2026-81891: Unrestricted Upload of File with Dangerous Type
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect without passing the result through mimeTypeNormalize. Because the .phtml, .phar, .php5, and .php3 extension...
Medium: gd
Issue Overview: NOTE: Fixed by: https://github.com/php/php-src/commit/b590f0380fda26ed180874a0255f0be078434315 php-8.4.24 DEBIANBUG: 1143152 CVE-2026-9672 Affected Packages: gd Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference betwe...
PT-2026-84041
Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the preview-link endpoint and the src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php file where VIEW permissions are not enforced f...
ROS-20260831-73-0019
The vulnerability of the DOMNode::C14N method in the PHP programming language is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause service failures remotely...
ROS-20260831-73-0017
The vulnerability of the DOMNode::C14N method in the PHP programming language is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause service failures remotely...
ROS-20260831-73-0018
The vulnerability of the DOMNode::C14N method in the PHP programming language is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability can allow an attacker to cause service failures remotely...