CVE-2024-44902

CVE-2024-44902 취약점 설명 ThinkPHP v6.1.3 v8.0.4에서 발견된 역직렬화 취약점으로, 공격자가 임의 코드를 실행할 수 있습니다. 영향을 받는 버전 ThinkPHP v6.1.3 v8.0.4 악용 조건 ThinkPHP 프레임워크에 Memcached 확장이 설치되어 있어야 합니다. 취약점 증명 테스트 환경: php8.0.7 + thinkphp8.0.4 + memcached3.2.0 먼저, app\controller\Index.php에 새로운 역직렬화 엔드포인트를 추가합니다. 예를 들어:...

Symfony Profiler - Remote Access via Injected Arguments

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — CodeIgniter 4 검증 규칙 주입 CVE-2023-32692 는 CodeIgniter 4 PHP 프레임워크의 코드 주입 취약점으로, 4.0.0부터 4.3.4까지 의 버전에 영향을 미칩니다. 4.3.52023년 6월 출시에서 수정되었습니다. 이것은 이 취약점을 가지고 놀고 싶은 사람을 위한 데모 환경입니다. 취약점 세부 정보는 MOGWAI LABS 블로그에서 확인할 수 있습니다. PoC 환경 이 저장소는 취약점을 보여주는 최소한의 CodeIgniter 4 애플리케이션을 포함합니다. Dev...

PHPunit-Exploit

PHPunit Exploiter + Checker CVE-2017-9841 Обзор: PHPUnit — это фреймворк для модульного тестирования языка программирования PHP. Это пример архитектуры xUnit для фреймворка модульного тестирования, который зародился в SUnit и стал популярным благодаря JUnit. PHPUnit был создан Себастьяном...

CVE-2026-53933

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-55250

Maravel Framework (a PHP dependency-injection framework), prior to version 10.74.0 , is affected by a Token Replay Vulnerability (CVSS 8.7 HIGH). The root cause is a lifecycle mismatch: tymon/jwt-auth writes 14-day JWT blacklist entries into tagged cache, but Maravel's O(1) Atomic Lazy Eviction m...

CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

symfony

Symfony는 웹 및 콘솔 애플리케이션을 위한 PHP 프레임워크 이자 재사용 가능한 PHP 컴포넌트 세트입니다. Symfony는 수천 개의 웹 애플리케이션과 대부분의 인기 있는 PHP 프로젝트에서 사용됩니다. 설치 Symfony 설치를 Composer로 수행하세요 요구 사항 세부 정보 참조. Symfony는 시맨틱 버전 관리를 엄격히 따르며, "장기 지원"LTS 버전을 게시하고 예측 가능하고 비즈니스 친화적인 릴리스 프로세스를 가지고 있습니다. 후원 Symfony 8.2는 후원자를 찾고 있습니다. 후원을 통해 Symfony...

MINI-PHFW-96XM-7673

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2026-77634

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail heade...

DEBIAN-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

DEBIAN-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

UBUNTU-CVE-2026-77634

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

UBUNTU-CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2026-77634 CakePHP: SmtpTransport vulnerable to CRLF header injection

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders or Message::addHeaders do not have CRLF bytes removed, allowing header injection when user-controlled...

CVE-2026-77634

Removed by vendor...

CVE-2026-59989

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

EUVD-2026-64140

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...