110422 matches found
EUVD-2025-211055
The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly...
php-reverse-shell
php-reverse-shell...
snuffleupagus
Snuffleupagus Security module for php7 and php8 - Killing bugclasses and virtual-patching the rest! Key Features • Download • Examples • Documentation • License • Thanks Snuffleupagus is a PHP 7+ and 8+ module designed to drastically raise the cost of attacks against websites, by killing entire b...
php-malware-finder
PHP Malware Finder | || || || | | | | || || | | || || || | Webshell finder, | || || | kiddies hunter, | | | |||| || | website cleaner. || || |||| Detecta archivos PHP potencialmente maliciosos. ¿Qué detecta? PHP-malware-finder hace todo lo posible para detectar código ofuscado/sospechoso, así com...
Yii2 PHP Framework < 2.0.52 - Remote Code Execution
Yii2 PHP Framework before 2.0.52 is vulnerable to remote code execution via improper validation of the class key in JSON behaviors. An attacker can instantiate arbitrary PHP classes and achieve RCE. id: CVE-2024-58136 info: name: Yii2 PHP Framework 2.0.52 - Remote Code Execution author:...
CLEANSTART-2026-GS69152 When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, ...
Security vulnerability affects the php package. When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP...
CLEANSTART-2026-OZ96009 Security fix for GHSA-ch8v-r6jh-4vvr applied in: php 8.3.35-r0
Security vulnerability affects the php package. This issue is resolved in later releases. See references for vulnerability details...
CLEANSTART-2026-PP41218 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit
Security vulnerability affects the php package. cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit...
CLEANSTART-2026-HM12202 convert
Security vulnerability affects the php package. The convert...
CLEANSTART-2026-XM64150 IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen
Security vulnerability affects the php package. The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen...
CLEANSTART-2026-NP31070 When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location
Security vulnerability affects the php package. When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location...
CLEANSTART-2026-AU05968 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name
Security vulnerability affects the php package. PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name...
CLEANSTART-2026-JC19240 php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl
Security vulnerability affects the php package. phpopensslmatcheswildcardname in ext/openssl/xpssl...
CLEANSTART-2026-ZN45327 phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check
Security vulnerability affects the php package. phartarnumber parses the octal size field of a TAR header into a uint32t with no overflow check...
CLEANSTART-2026-UY82629 mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them
Security vulnerability affects the php package. The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them...
CLEANSTART-2026-WW44198 SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger
Security vulnerability affects the php package. The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger...
PT-2026-108917
Name of the Vulnerable Software and Affected Versions Fuelthemes The Voux versions prior to 6.9.5 Description Fuelthemes The Voux contains an improper control of filename for include/require statement in PHP program, which allows for PHP Local File Inclusion. This occurs when the application fail...
PT-2026-108903
Name of the Vulnerable Software and Affected Versions Fuelthemes Werkstatt versions prior to 4.8.3 Description Fuelthemes Werkstatt contains an improper control of filename for include/require statement in PHP program, which allows for PHP Local File Inclusion. This occurs when the application...
PT-2026-109177
Stack-based Buffer Overflow, Integer Overflow or Wraparound vulnerability in Apache Thrift php bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...
PT-2026-109207
Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...