CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

ThinkPHP security vulnerabilities

ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology ThinkPHP. A security vulnerability exists in ThinkPHP version v.3.2.5, which originates from the index.php component that allows execution of arbitrary code...

PT-2025-31940 · Thinkphp3 · Thinkphp3

Name of the Vulnerable Software and Affected Versions: thinkphp3 version 3.2.5 Description: An issue in thinkphp3 allows a remote attacker to execute arbitrary code via the index.php component. This can be achieved through crafted template inclusion, requiring no login. Recommendations: Block...

CVE-2025-50707

An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component...

CVE-2025-50707

An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component...

CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

CVE-2025-50707

An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component...

CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

ThinkPHP security vulnerabilities

ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology ThinkPHP. A security vulnerability exists in thinkphp version v.5.1, which stems from a routecheck function that allows execution of arbitrary code...

CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

CVE-2025-50706

The ThinkPHP Framework (v.5.1) is vulnerable to Remote Code Execution (RCE) due to improper input handling and insufficient path validation within the routecheck function. An attacker can exploit this Directory Traversal vulnerability by sending specially crafted requests—such as using "dot-dot-s...

CVE-2025-50706

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

CVE-2025-50706: Improper Control of Generation of Code

An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function...

OneBase code injection vulnerability

OneBase is Bigotry individual developers of an open source free infrastructure based on ThinkPHP5 development. A code injection vulnerability exists in OneBase 1.3.6 and earlier versions, which originates from a cross-site scripting attack due to the incorrect operation of the parameter args in t...

DaiCuo security vulnerabilities

DaiCuo DaiCuo is an adaptive backend management framework based on ThinkPHP, Bootstrap and Jquery by China-based DaiCuo. A security vulnerability exists in DaiCuo 1.3.13 and earlier versions, which stems from a cross-site request forgery due to incorrect operation of the file /admin.php/addon/ind...

CVE-2024-34467

ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in thinkexception.tpl...

CVE-2024-44902

A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code...

CVE-2024-48112

A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code...

CVE-2022-25481

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode...

CVE-2022-47945

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php...