110386 matches found
PT-2026-78953
Unauthenticated PHP Object Injection in Forminator = 1.57.0 versions...
ALSA-2026:57574 Important: php:8.2 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...
ALSA-2026:57539 Important: php:8.3 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...
CVE-2026-66586: Improper Control of Filename for Include/Require Statement in PHP Program
Author Local File Inclusion in WP Cafe Pro 3.0.15 versions...
RHEL 8 : php:8.2 (RHSA-2026:57574)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57574 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection vi...
RockyLinux 9 : php:8.3 (RLSA-2026:57539)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:57539 advisory. php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archiv...
VulnCheck KEV: CVE-2026-77647
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...
PT-2026-79268
Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.20 Description Unauthenticated remote attackers can execute arbitrary code due to the incorrect identification of ?php blocks and the mishandling of certain cases, such as the presence of a character, within the var...
SPIP X-Spip-Filtre Unauthenticated RCE
This module exploits a PHP function-call injection in SPIP's template engine. The analyseresultatskel function extracts patterns from the rendered page body and calls the listed functions as template filters. A newline character is injected into a GET parameter value, which places a header call o...
Important: php:8.2 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...
Important: php:8.3 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...
RHEL 9 : php:8.3 (RHSA-2026:57539)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57539 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection vi...
TeamPass v3.2.1.7
TeamPass 3 TeamPass is a Collaborative Passwords Manager solution installed On-Premise. Copyright © 2009-2026, Nils Laumaillé Requirements About PHP versions Installation Traditional Installation Recommended Docker Documentation Languages Licence Agreement Website Bugs Requirements MySQL 5.7 or...
CVE-2026-76572
A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23...
MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...
GHSA-7M52-JW36-44R3 MCP PHP SDK: client HttpTransport SSE buffer (sseBuffer .= chunk) grows unbounded when server withholds the event delimiter
Summary The HTTP client transport in mcp/sdk reads a Server-Sent-Events SSE response stream incrementally and appends each 4 KiB chunk to an in-memory buffer $this-sseBuffer .= $chunk; with no upper bound. The buffer is only ever flushed when an SSE event delimiter "\n\n" appears. A remote MCP...
Insufficient Logging
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Insufficient Logging in the AuthLdap::create function. An attacker can gain unauthorized access to a previously blocked account by authenticating via...
External Control of File Name or Path
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to External Control of File Name or Path in the PDF export process. An attacker can access sensitive local files by embedding an tag with a src attribute...
Missing Authorization
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Missing Authorization via the admin API endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration. An attacker can access sensitive...
Information Exposure
Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Information Exposure via the pdf.php endpoint. An attacker can access sensitive metadata, including titles, solution IDs, author names, and last-update...