php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpcdecode can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64decodexmlrpc in ext/xmlrpc/libxmlrpc/base64.c...

SQL Injection Vulnerability in B2C Single Merchant Mall System

B2C single merchant mall system is a PHP open source e-commerce system designed and developed independently by Shanxi Niu Cool Information Technology Co. B2C single merchant mall system SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive database information...

The vulnerability of the exif_read_data function in the PHP programming language, related to reading beyond the buffer boundaries, allows attackers to disclose protected information or cause service failures.

The vulnerability of the exifreaddata function in the PHP programming language arises from an operation that occurs outside the buffer in memory. Exploiting this vulnerability can allow a malicious actor to disclose protected information or cause service failures...

Adive Framework Cross-Site Request Forgery Vulnerability

Adive Framework is a PHP-based MySQL database management framework . A cross-site request forgery vulnerability exists in Adive Framework. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could exploit this...

School Management Software PHP/mySQL CSRF Vulnerability

School Management Software PHP/mySQL is a WEB school ERP management program. A cross-site request forgery vulnerability exists in School Management Software PHP/mySQL 2019-03-14 and prior versions. The vulnerability stems from the WEB application not adequately verifying that requests are coming...

Car Rental Project Remote Code Execution Vulnerability

Car Rental Project is a PHP development project. A remote code execution vulnerability exists in Car Rental Project version 1.0, which can be exploited by attackers to upload malicious files...

Xiuno BBS code issue vulnerability

Xiuno BBS is an open source forum program based on PHP and MySQL. A code issue vulnerability exists in Xiuno BBS version 4.0. The vulnerability stems from an improperly designed or implemented problem in the code development process of a web system or product. No detailed vulnerability details ar...

Remote code execution vulnerability in ECShop backend te***.php file

ECShop is a B2C independent online store system, suitable for enterprises and individuals to quickly build a personalized online store. The system is based on PHP language and MYSQL database structure development of cross-platform open source program. ECShop background te.php file remote code...

XSS Vulnerability in RGCMS RuiGu Information Management System

RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS RuiGu Information Management System has an XSS vulnerability that can be exploited by an attacker t...

WordPress Social Photo Gallery Remote Code Execution Vulnerability

WordPress is a suite of blogging platforms from the WordPress Foundation developed using the PHP language.Social Photo Gallery is the ultimate lightbox plugin for WordPress. A remote code execution vulnerability exists in WordPress Social Photo Gallery, which can be exploited by an attacker to...

Code execution vulnerability in SeaCMS backend (CNVD-2019-45348)

SeaCMS is a station building system based on PHP+MYSQL architecture and supports cross-platform operation. A code execution vulnerability exists in the background of SeaCMS, which can be exploited by attackers to execute malicious code...

php: memcpy with negative length via crafted DNS response

An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dnsgetrecord misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects phpparser...

USN-4166-2 php5 vulnerability

USN-4166-1 fixed a vulnerability in PHP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain paths when being used in FastCGI configurations. A remote attacker could possibly use...

UBUNTU-CVE-2019-11043

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution...

Code execution vulnerability in rgcms

RuiGu information management system RGCMS is a set of open source station management system , using PHP language , the system features free , extended , extremely fast security , free and open source. rgcms there are code execution vulnerabilities , attackers can exploit vulnerabilities to obtain...

Command Execution Vulnerability in CMS Co***.php File

Xunrui CMS content management framework is based on PHP7 language using the latest CodeIgniter4 as a development framework for the production of web content management framework, providing "computer site + mobile site + APP interface" integrated web technology solutions. A command execution...

php: Heap buffer overflow in function exif_process_IFD_TAG()

When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.28, 7.2.x below 7.2.17 and 7.3.x below 7.3.4 can be caused to read past allocated buffer in exifprocessIFDTAG function. This may lead to information disclosure or crash...

php: Out-of-bound read in timelib_meridian()

In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelibmeridian handling of 'front of' and 'back of' directives could be used by attackers able to supply date strings to leak information from the interpreter, related to ext/date/lib/parsedate.c...

php: Stack-based buffer under-read in php_stream_url_wrap_http_ex() in http_fopen_wrapper.c when parsing HTTP response

In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the phpstreamurlwraphttpex function in ext/standard/httpfopenwrapper.c. This subsequently results in copying a large string...

php: Out-of-bounds read in base64_decode_xmlrpc in ext/xmlrpc/libxmlrpc/base64.c

An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. xmlrpcdecode can allow a hostile XMLRPC server to cause PHP to read memory outside of allocated areas in base64decodexmlrpc in ext/xmlrpc/libxmlrpc/base64.c...