CVE-2026-1874

creationtimestamp| type| source ---|---|--- 2026-03-03 08:21:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg5dlj6nfy2x 2026-03-03 08:36:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mg5egelkcg27 2026-03-03 09:00:31+00:00| seen|...

BIT-LIBPHP-2024-5585 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command ar...

TencentOS Server 4: php (TSSA-2025:0004)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0004 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2021-1874

A logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPadOS 14.5. An application may be able to execute arbitrary code with kernel privileges...

CVE-2020-1874

NIP6800;Secospace USG6600;USG9500 products versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have a invalid pointer access vulnerability. The software system access an invalid pointer when operator logs in to the device and performs some operations. Successful exploit could cause...

CVE-2025-1874

creationtimestamp| type| source ---|---|--- 2025-03-03 13:30:10+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/6195 2025-03-03 15:32:53+00:00| seen| https://t.me/cvedetector/19349...

CVE-2025-1874

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "description" parameter in admin/add-category.php...

CVE-2025-1874 SQL injection vulnerability in 101news

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "description" parameter in admin/add-category.php...

CVE-2025-1874

CVE-2025-1874 affects 101news v1.0; the vulnerability is an SQL injection in the admin/add-category.php script’s description parameter. Public sources (NVD/Red Hat/CVE records) report impact as high across confidentiality, integrity, and availability (CVSS v3.1 score 9.8; CVSS v4.0 score 9.3). Ex...

Exploit for CVE-2023-1874

CVE-2023-1874 Disclaimer THIS SCRIPT IS DESIGNED FOR WHIT...

Exploit for Improper Encoding or Escaping of Output in Php

CVE-2024-1874 Proof Of Concept for CVE-2024-1874https://nvd...

CVE-2024-1874 affecting package php for versions less than 8.3.8-1

CVE-2024-1874 affecting package php for versions less than 8.3.8-1. An upgraded version of the package is available that resolves this issue...

CBL Mariner 2.0 Security Update: php (CVE-2024-1874)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-1874 advisory. - In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, when using procopen command with arra...

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

...

BIT-PHP-2024-5585 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command ar...

CVE-2024-5585

In PHP, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments tha...

PHP 8.1.x < 8.1.29 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.29, 8.2.x prior to 8.2.20, or 8.3.x prior to 8.3.8. It is, therefore, affected by multiple vulnerabilities: - An argument Injection in PHP-CGI with a bypass of CVE-2012-1823...

PHP 8.3.x < 8.3.8 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.29, 8.2.x prior to 8.2.20, or 8.3.x prior to 8.3.8. It is, therefore, affected by multiple vulnerabilities: - An argument Injection in PHP-CGI with a bypass of CVE-2012-1823...

CVE-2024-5585 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command ar...

CVE-2024-5585 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command ar...