BIT-PHP-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

BIT-PHP-MIN-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

BIT-PHP-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it...

BIT-LIBPHP-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which redirect target is built, so a malicious server...

BIT-LIBPHP-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

BIT-LIBPHP-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

BIT-LIBPHP-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

BIT-LIBPHP-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-64947 CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager

A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitrary PHP code, resulting in Remote Code Execution. This issue affects Pandora FMS: from 777 onwards...

CVE-2026-86610

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

thrift: Apache Thrift: PHP `thrift_protocol` accelerator dereferences a missing container-element spec

A flaw was found in Apache Thrift. A remote attacker could trigger a Denial of Service DoS by submitting specially crafted input to an application utilizing the PHP bindings. This condition causes a null pointer dereference, crashing the service and rendering it unavailable to legitimate users...

thrift: Apache Thrift: php `--gen php:inlined` struct readers (and `TProtocol::skipBinary`) have no recursion-depth guard

A flaw was found in Apache Thrift's PHP bindings. A remote attacker could cause a denial of service DoS by sending specially crafted input that triggers uncontrolled recursion. This excessive recursion can exhaust system resources or stack space, leading to an application crash...

thrift: Apache Thrift: Denial of Service via uncontrolled resource allocation in PHP bindings

A flaw was found in the Apache Thrift PHP bindings. Due to a lack of limits or throttling on resource allocation, a remote attacker can send crafted requests that consume excessive system resources. This issue can lead to a Denial of Service DoS for the affected service...

thrift: thrift: Denial of Service via buffer overflow in PHP bindings

A flaw was found in Apache Thrift. An integer overflow within the PHP bindings leads to a stack-based buffer overflow when processing specially crafted data. A remote, unauthenticated attacker could exploit this flaw to crash the service, leading to a Denial of Service DoS...

apache/thrift: thrift: Apache Thrift: PHP `TJSONProtocol` string/number readers have no size bound

A flaw was found in Apache Thrift's PHP bindings. A remote, unauthenticated attacker can exploit this vulnerability by sending requests that trigger unbounded resource allocation without proper limits or throttling. This failure to control consumption can exhaust system resources, resulting in a...

thrift: Apache Thrift: PHP `thrift_protocol` accelerator: zero-byte container elements

A flaw was found in Apache Thrift's PHP bindings. A remote attacker can exploit this vulnerability by sending specially crafted input containing improperly validated quantity values. This causes the application to perform excessive iterations and consume memory or CPU resources without limits,...

thrift: Apache Thrift: PHP framed/memory/HTTP transports re-slice the buffer on every read (quadratic)

A flaw was found in Apache Thrift's PHP bindings. A remote attacker can exploit this issue to cause a Denial of Service DoS by sending specially crafted input. Due to inefficient algorithmic processing, handling these requests consumes disproportionate computing resources, causing the application...

CVE-2026-86610

The Download Manager WordPress plugin (versions before 3.3.71 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient sanitization and escaping of a package setting before it is rendered on a page; specifically, the sanitization logic fails to neutralize single quote...

CVE-2026-86610 Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon

The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in a page, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor who opens the package's...

CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...