Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

EUVD-2026-31190

Yii 2 is a PHP application framework. Versions 2.0.54 and prior contain flawed logic in the core view rendering method View::renderPhpFile that leads to Local File Inclusion. The function calls extract$params, EXTROVERWRITE before the require statement that loads the view file. As a result, a...

Flight SQL注入漏洞

Flight is a PHP microframework developed by Mike Cao. Versions of Flight prior to 3.18.1 contained an SQL injection vulnerability. This vulnerability occurred because the methods SimplePdo::insert, SimplePdo::update, and SimplePdo::delete directly concatenated the $table parameter and the keys fr...

PT-2026-38271

Name of the Vulnerable Software and Affected Versions Flight versions prior to 3.18.1 Description The make:controller CLI command allows arbitrary directory creation outside the project root. This occurs because the command calls mkdir..., recursive: true on a path constructed from a user-supplie...

EyouCMS 注入漏洞

EyouCMS is an open-source content management system CMS developed by Eyou Corporation in China, based on ThinkPHP. EyouCMS versions 1.7.9 and earlier have a vulnerability related to injection attacks. This vulnerability arises from improper handling of the editFile function in the file...

tpAdmin 代码问题漏洞

tpAdmin is a management backend developed by Ethan as an individual developer, based on ThinkPHP5. Versions of tpadmin 1.3.12 and earlier have code vulnerabilities. These vulnerabilities stem from incorrect operations with the library...

CVE-2026-25236

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe literal substitution for an IN ... list. This issue has been patched in version 1.33.0...

ROS-20251223-7315

Vulnerability in php-symfony4 related to the use of non-canonical url-paths for authorization solutions. Exploitation of the vulnerability could allow an attacker acting remotely to escalate their privileges...

EUVD-2020-1452

Malware in sbrugna...

EUVD-2021-2479

Malware in sbrugna...

EUVD-2020-1470

Malware in sbrugna...

EUVD-2010-4962

Malware in sbrugna...

EUVD-2021-2170

Malware in sbrugna...

EUVD-2020-1454

Malware in sbrugna...

EUVD-2022-6298

Malicious code in bioql PyPI...

EUVD-2023-2754

Malicious code in bioql PyPI...

EUVD-2022-0465

Malicious code in bioql PyPI...

EUVD-2024-3234

Malicious code in bioql PyPI...

EUVD-2022-2916

Malicious code in bioql PyPI...

EUVD-2023-0611

Malicious code in bioql PyPI...