CVE-2021-36564

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php...

CVE-2021-36567

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache...

CVE-2020-20120

ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods...

CVE-2020-35339

In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server...

CVE-2020-19705

thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home=message=add...

CVE-2018-18529

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI...

SchoolCMS 注入漏洞

SchoolCMS is Devil individual developer of a set of open source school teaching management system based on ThinkPHP framework. The system includes student management, grade management and teacher management. SchoolCMS version 2.3.1 suffers from an injection vulnerability , the vulnerability stems...

EyouCMS 代码问题漏洞

EyouCMS is an open source content management system CMS based on ThinkPHP by China's Eyou. A code issue vulnerability exists in EyouCMS version 1.5.6, which stems from an unrestricted file upload issue contained in the Website Logo Handler component...

Understanding Deserialization

Thinkphp is vulnerable to Understanding Deserialization. The vulnerability is due to improper validation and handling of serialized user input in the \controller\Index.php component, allowing attackers to execute arbitrary code...

ThinkAdmin 代码问题漏洞

ThinkAdmin is ThinkAdmin open source a set of general purpose backend management system based on ThinkPHP framework. A code issue vulnerability exists in ThinkAdmin 6.1.67 and earlier versions, which stems from improper handling of the parameter uptoken, leading to deserialization...

wtcms cross-site scripting vulnerability

wtcms is a ThinkPHP-based content management system CMS. A cross-site scripting vulnerability exists in version 1.0 of wtcms, which stems from unprocessed application parameters in the plupload method in the file AssetController.class.php, and can be exploited by an attacker to execute arbitrary...

GHSA-PJHX-J53P-C5F5 ThinkPHP deserialization vulnerability

A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code...

ThinkPHP deserialization vulnerability

A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code...

CVE-2024-48112

A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code...

CVE-2024-48112

A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code...

CVE-2024-48112

A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code...

PT-2024-32992 · Thinkphp · Thinkphp

Name of the Vulnerable Software and Affected Versions: Thinkphp versions 6.1.3 through 8.0.4 Description: A deserialization issue in the controllerIndex.php component allows attackers to execute arbitrary code. Recommendations: For versions 6.1.3 through 8.0.4, update to a version that contains a...

ThinkPHP 安全漏洞

Top Think Information Technology ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Think Information Technology Company. A security vulnerability exists in ThinkPHP versions 6.1.3 to 8.0.4, which stems from a deserialization vulnerability in...

CVE-2024-48112

A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code...

CVE-2024-48112

ThinkPHP deserialization vulnerability CVE-2024-48112 affects ThinkPHP v6.1.3–v8.0.4 in the \controller\Index.php component, allowing arbitrary code execution due to deserializing untrusted data. Impact is code execution with high severity; exploit details are not consistently published across so...