versionscan

versionscan Versionscan은 현재 설치된 PHP 버전을 평가하고 알려진 CVE 및 해당 버전이 수정된 버전과 비교하여 잠재적인 문제를 보고하는 도구입니다. 참고: 보안 수정을 백포트하는 Linux 배포판에 도구를 적용하는 작업이 아직 진행 중입니다. 현재로서는 보고된 정확한 버전에 대해서만 결과를 반환합니다. 설치 Composer 사용 "require": "psecio/versionscan": "dev-master" 현재 유일한 종속성은 Symfony 콘솔입니다. 사용법 현재 PHP 버전에 대해 스캔을 실행하려...

versionscan

versionscan Versionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. PLEASE NOTE: Work is still in progress to adapt the tool to linux distributions that backport security fixe...

joomla_rce_CVE-2015-8562

joomlarceCVE-2015-8562 Joomla! 3.4.6 미만의 모든 버전은 취약한 것으로 알려져 있습니다. 그러나 PHP 버전이 5.5.29, 5.6.13 및 5.5 미만인 경우에만 악용이 가능합니다. 데모 : https://www.youtube.com/watch?v=twqYpn1ir4o...

WordPress Redux Framework <=4.2.11 - Information Disclosure

WordPress Redux Framework plugin through 4.2.11 is susceptible to information disclosure. The plugin registers several unique AJAX actions available to unauthenticated users in the includes function in redux-core/class-redux-core.php. These are predictable, given that they are based on an md5 has...

CVE-2026-46420

CVE-2026-46420 PoC 저장소에서 관리하는 파일로부터 PHP 버전을 로드할 때 shivammathur/setup-php에서 발생하는 명령어 삽입Command injection 취약점입니다. 영향 받는 버전: = 2.25.0, = 2.37.1 PoC 대상 저장소에는 이미 취약한 워크플로우가 있어서, Pull Request 내용을 체크아웃하고 [email protected]을 실행합니다. 공격자는 composer.json만 변경합니다. -"php": "8.2" +"php": + "8.2;sed -i...

K000162775: PHP Phar vulnerability CVE-2026-7260

Security Advisory Description Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9. CVE-2026-7260 Impac...

Exploit for CVE-2026-17543

PHP CVE-2026-17543 Exposure Validator Safe network-side valid...

php:8.2 security, bug fix, and enhancement update

libzip php 8.2.32-1 - rebase to 8.2.32 php-pear php-pecl-apcu php-pecl-rrd php-pecl-xdebug3 php-pecl-zip...

PT-2026-67348

Name of the Vulnerable Software and Affected Versions php affected versions not specified gd affected versions not specified Description Security issues were identified in the php and gd packages within the openSUSE Tumbleweed distribution. Recommendations Update php to version 8.5.9-1.1. Update ...

Fedora 44 : php (2026-6131a972fe)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-6131a972fe advisory. PHP version 8.5.9 30 Jul 2026 Core: Fixed bug GH-22290 AST pretty printing does not correctly handle strings containing NUL. iliaal Fixed bug GH-222...

CVE-2026-17544

Attacker-provided inputs to bccomp could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4. before 8.4.24 and from 8.5. before 8.5.9...

PT-2026-66457

Name of the Vulnerable Software and Affected Versions PHP versions 8.2.0 through 8.2.32 PHP versions 8.3.0 through 8.3.32 PHP versions 8.4.0 through 8.4.23 PHP versions 8.5.0 through 8.5.8 Description Improper escaping of backslashes in attacker-provided parameters allows for SQL injection, a...

Updated php8.4 and php8.5 packages fix security vulnerabilities

The updated php8.4 and php8.5 packages fix several security issues, e.g. Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD. CVE-2026-14355...

Oracle Linux 9 : php:8.2 (ELSA-2026-40416)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-40416 advisory. php 8.2.32-1 - rebase to 8.2.32 php-pecl-apcu 5.1.23-1 - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd 2.0.3-4 - build for PHP 8.1 2070040 2.0.3-3 -...

Amazon Linux 2 : php, --advisory ALAS2PHP8.2-2026-012 (ALASPHP8.2-2026-012)

The version of php installed on the remote host is prior to 8.2.32-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2PHP8.2-2026-012 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted...

Oracle Linux 10 : php8.4 (ELSA-2026-22649)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22649 advisory. 8.4.21-2 - rebase to 8.4.21 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

Exploit for CVE-2026-46420

CVE-2026-46420 PoC Command injection in shivammathur/setup-p...

CVE-2026-46420 setup-php: Command Injection in Repository-Derived PHP Version Resolution

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...

EUVD-2026-45303

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...

CVE-2026-46420 setup-php: Command Injection in Repository-Derived PHP Version Resolution

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and...