111326 matches found
PT-2026-75382
TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p3+tuxcare...
CVE-2026-18766: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in chetans9 core-php-admin-panel up to 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f. This issue affects some unknown processing of the file /Applications/MAMP/htdocs/core-php-admin-panel-master/customers.php. Executing a manipulation of the argument filtercol can lead to sql...
CVE-2026-16618: Unrestricted Upload of File with Dangerous Type
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...
PT-2026-67841
Name of the Vulnerable Software and Affected Versions MaxSite CMS affected versions not specified Description An issue allows unauthenticated attackers to achieve persistent remote code execution as the web-server process user. By submitting crafted POST requests to the 'install' endpoint after t...
Important: vim
Issue Overview: Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents of the edited buffer, into a search pattern that is run via winexecute without escapin...
PT-2026-68506
Name of the Vulnerable Software and Affected Versions Ajax Search Lite versions prior to 4.14.5 Description The Ajax Search Lite – Live Search & Filter plugin for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object...
CVE-2026-70554: Deserialization of Untrusted Data
MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...
Critical: php
Issue Overview: Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-17543 Circular symbolic links in phar archives cou...
PT-2026-73958
TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.3.4-p1+tuxcare...
PT-2026-67666
The Improve SEO WordPress plugin through 2.0.11 does not properly validate uploaded files, checking only the file content type while writing the file with the attacker-supplied extension into a publicly accessible directory, allowing unauthenticated users to upload executable PHP files and achiev...
PT-2026-76395
This update brings the latest version of php 8.2 and fixes some security vulnerabilities...
PT-2026-73725
TuxCare rebuilt aws/aws-sdk-php to address 1 CVE. Fixed in 3.263.4-p1+tuxcare...
php8.4 security, bug fix, and enhancement update
8.4.23-1 - rebase to 8.4.23...
Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-2044)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2044 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...
Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-2042)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2042 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...
Amazon Linux 2 : vim, --advisory ALAS2-2026-3829 (ALAS-2026-3829)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3829 advisory. Vim is an open source, command line text editor. Prior to 9.2.0736, the PHP omni-completion script in runtime/autoload/phpcomplete.vim interpolates a class or trait name, taken from the contents ...
Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-2041)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2041 advisory. Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24...
thrift: Apache Thrift: Denial of Service via infinite loop
A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...
