CVE-2024-44902

CVE-2024-44902 Descripción de la vulnerabilidad Una vulnerabilidad de deserialización en Thinkphp v6.1.3 a v8.0.4 permite a atacantes ejecutar código arbitrario. Versiones afectadas Thinkphp v6.1.3 a v8.0.4 Condición de explotación El framework thinkphp debe tener instalada la extensión Memcached...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 Validation Rule Injection CVE-2023-32692 is a code injection vulnerability in the CodeIgniter 4 PHP framework, affecting versions 4.0.0 through 4.3.4. It was fixed in 4.3.5 released June 2023. This is a demo environment for anyone that wants to play with it...

PHPunit-Exploit

PHPunit Explotador + Comprobador CVE-2017-9841 Resumen : PHPUnit es un marco de pruebas unitarias para el lenguaje de programación PHP. Esta es una arquitectura xUnit de muestra para un marco de pruebas unitarias que se originó con SUnit y se popularizó con JUnit. PHPUnit fue creado por Sebastian...

symfony

Symfony es un framework de PHP para aplicaciones web y de consola, y un conjunto de componentes PHP reutilizables. Symfony es utilizado por miles de aplicaciones web y por la mayoría de los proyectos PHP populares. Instalación Instalar Symfony con Composer consulte los detalles de requisitos...

CVE-2026-53933

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-55250

Maravel Framework (a PHP dependency-injection framework), prior to version 10.74.0 , is affected by a Token Replay Vulnerability (CVSS 8.7 HIGH). The root cause is a lifecycle mismatch: tymon/jwt-auth writes 14-day JWT blacklist entries into tagged cache, but Maravel's O(1) Atomic Lazy Eviction m...

CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

MINI-PHFW-96XM-7673

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2026-77634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail heade...

DEBIAN-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

DEBIAN-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

UBUNTU-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

UBUNTU-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77634

Removed by vendor...

CVE-2026-59989

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

EUVD-2026-64140

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...