CVE-2026-33347

league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like...

php:php-fuzz-parser: Heap-use-after-free in destroy_op_array

Detailed Report: https://oss-fuzz.com/testcase?key=5354085365907456 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-parser Job Type: aflasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x7674a2cf5490 Crash State: destroyoparray fuzzerdorequestfrombuffer...

EUVD-2024-53515

Malicious code in bioql PyPI...

EUVD-2024-50002

Malicious code in bioql PyPI...

CVE-2024-9546

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57071

The php-parser software, specifically version v3.2.1 , is vulnerable to a prototype pollution (CWE-1321) flaw within the lib.combine function. An attacker can exploit this by supplying a crafted payload to trigger a Denial of Service (DoS) . As a temporary workaround, users are advised to disable...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

PT-2025-5770 · Unknown · Php-Parser

Name of the Vulnerable Software and Affected Versions: php-parser version 3.2.1 Description: A prototype pollution in the lib.combine function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For php-parser version 3.2.1, consider disabling the...

CVE-2024-57071: Improperly Controlled Modification of Object Prototype Attributes

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-9546

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546: Exposure of Sensitive Information to an Unauthorized Actor

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546

CVE-2024-9546 affects the WPIDE – File Manager & Code Editor WordPress plugin (versions up to and including 3.4.9). The issue is an Unauthenticated Full Path Disclosure caused by the plugin’s use of the PHP-Parser library, which outputs parser rebuild command results. The disclosed information ca...

CVE-2024-9546 WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546 WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

WordPress plugin WPIDE 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An information...