CVE-2024-44902

CVE-2024-44902 Vulnerability description A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. Affects Version Thinkphp v6.1.3 to v8.0.4 Exploit condition The thinkphp framework should have installed the Memcached extension. Vulnerability...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — Inyección de reglas de validación en CodeIgniter 4 CVE-2023-32692 es una vulnerabilidad de inyección de código en el framework PHP CodeIgniter 4, que afecta a las versiones 4.0.0 a 4.3.4. Se corrigió en 4.3.5 publicada en junio de 2023. Este es un entorno de demostración para...

PHPunit-Exploit

PHPunit Exploiter + Checker CVE-2017-9841 Overview : PHPUnit is a unit test framework for the PHP programming language. This is a sample xUnit architecture for a unit testing framework that originated with SUnit and became popular with JUnit. PHPUnit was created by Sebastian Bergmann Installation...

symfony

Symfony 是一个用于Web和控制台应用程序的 PHP框架 ，也是一组可复用的 PHP组件 。Symfony被成千上万的Web应用程序以及大多数 流行的PHP项目 所使用。 安装 使用 Composer 安装 Symfony（参见 需求细节）。 Symfony 严格遵守 语义化版本控制，发布“长期支持 LTS”版本，并拥有可预测且对业务友好的 发布流程。 赞助 Symfony 8.2 正在寻找 支持者。 通过 赞助 其开发来帮助 Symfony！ 文档 如果你是 Symfony 新手，请阅读 入门指南。 尝试 Symfony 演示应用，在实践中学习 Symfony。 通过 Symfo...

Linux Distros Unpatched Vulnerability : CVE-2026-77634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail heade...

DEBIAN-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

DEBIAN-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

UBUNTU-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

UBUNTU-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77634

Removed by vendor...

CVE-2026-59989

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

EUVD-2026-64140

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CLSA-2026-1787002033 TuxCare security update for yiisoft/yii2-dev (1 CVE)

TuxCare rebuilt yiisoft/yii2-dev to address 1 CVE. Fixed in 2.0.54-p1+tuxcare...

UBUNTU-CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

CVE-2026-53593

FreeScout prior to 1.8.224 is vulnerable to authenticated remote code execution due to an incomplete denylist for dangerous upload extensions. The upload endpoint POST /uploads/upload stores files with their original extension in storage/app/public/uploads/ and serves them at /storage/uploads/. O...

CVE-2026-45074

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost, which reflects an attacker-controlled Host header when framework.trustedhosts is n...