110412 matches found
BIT-PHP-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
BIT-LIBPHP-2026-7260 Stack overflow in phar with circular symlinks
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
BIT-LIBPHP-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale
Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...
BIT-LIBPHP-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
tirreno v0.10.1
tirreno tirreno is a security framework. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your product from threats, fraud, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised accounts and application logic abuse...
vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion
A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remo...
PT-2026-76881
Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description A security flaw allows remote exploitation via cross site scripting XSS, a technique where malicious scripts are injected into trusted websites. The issue exists in the...
PT-2026-76882
A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit subject2.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made...
PT-2026-76883
A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit subject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit...
PT-2026-76720
Name of the Vulnerable Software and Affected Versions sqlparse versions prior to 0.6.0 Description The sqlparse/filters/output.py module fails to escape existing backslashes before quotes when using output format='python' or output format='php' in the sqlparse.format function and the correspondin...
PT-2026-73420
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
PT-2026-73422
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
PT-2026-73417
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
PT-2026-73366
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...
PT-2026-76767
Name of the Vulnerable Software and Affected Versions Forminator versions prior to the patch released in response to this disclosure Description An unauthenticated arbitrary file upload flaw allows an attacker to upload malicious PHP files to the server, leading to Remote Code Execution RCE, whic...
CVE-2026-75077: Improper Neutralization of Input During Web Page Generation
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly...
PT-2026-76827
Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description Remote cross site scripting occurs due to improper handling of the course argument within the '/BSCE2.php' endpoint. Cross site scripting is a technique where malicious...
PT-2026-73367
Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...
PT-2026-73419
Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...