CVE-2019-8923

CVE-2019-8923 affects XAMPP 5.6.8 and earlier. The vulnerability is a SQL injection in the cds-fpdf.php jahr parameter, allowing remote input-based database querying due to insufficient input validation. Impact is listed as high to critical in sources (NVD CVSS 2.0/3.0), with potential for unauth...

XAMPP 5.6.8 Cross Site Scripting / SQL Injection

!-- Exploit Title: Cross Site Scripting in XAMPP 5.6.8 and previous Date: 17-02-2019 Exploit Author: Rafael Pedrero Vendor Homepage: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/ Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/ Version: XAMP...

CVE-2015-3412

PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the streamresolveincludepath function in ext/standard/streamsfuncs.c, as...

PT-2015-3250 · Php +4 · Php +4

Name of the Vulnerable Software and Affected Versions: PHP versions prior to 5.4.40 PHP versions 5.5.x prior to 5.5.24 PHP versions 5.6.x prior to 5.6.8 Description: The issue is related to the lack of checking for %00 sequences in pathnames, which could allow remote attackers to read or write to...

FreeBSD : Several vulnerabilities found in PHP (1e232a0c-eb57-11e4-b595-4061861086c1)

The PHP project reports : The PHP development team announces the immediate availability of PHP 5.4.40. 14 security-related bugs were fixed in this release, including CVE-2014-9709, CVE-2015-2301, CVE-2015-2783, CVE-2015-1352. All PHP 5.4 users are encouraged to upgrade to this version. The PHP...

Fedora 22 : php-5.6.8-1.fc22 (2015-6195)

16 Apr 2015, PHP 5.6.8 Core : - Fixed bug 66609 php crashes with get and ++ operator in some cases. Dmitry, Laruence - Fixed bug 68021 getbrowser browsernameregex returns non-utf-8 characters. Tjerk - Fixed bug 68917 parseurl fails on some partial urls. Wei Dai - Fixed bug 69134 Per Directory...