CVE-2026-33347

league/commonmark is a PHP Markdown parser. From version 2.3.0 to before version 2.8.2, the DomainFilteringAdapter in the Embed extension is vulnerable to an allowlist bypass due to a missing hostname boundary assertion in the domain-matching regex. An attacker-controlled domain like...

php:php-fuzz-parser: Heap-use-after-free in destroy_op_array

Detailed Report: https://oss-fuzz.com/testcase?key=5354085365907456 Project: php Fuzzing Engine: afl Fuzz Target: php-fuzz-parser Job Type: aflasanphp Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x7674a2cf5490 Crash State: destroyoparray fuzzerdorequestfrombuffer...

EUVD-2024-53515

Malicious code in bioql PyPI...

EUVD-2024-50002

Malicious code in bioql PyPI...

CVE-2024-9546

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

PT-2025-5770 · Unknown · Php-Parser

Name of the Vulnerable Software and Affected Versions: php-parser version 3.2.1 Description: A prototype pollution in the lib.combine function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For php-parser version 3.2.1, consider disabling the...

CVE-2024-57071

The php-parser software, specifically version v3.2.1 , is vulnerable to a prototype pollution (CWE-1321) flaw within the lib.combine function. An attacker can exploit this by supplying a crafted payload to trigger a Denial of Service (DoS) . As a temporary workaround, users are advised to disable...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

@acanto/laravel-scripts (>=0.1.53, <=0.2.27), @alexlit/config-prettier (>=0.0.1, <=9.8.0) +90 more potentially affected by CVE-2024-57071 via php-parser (>=0.0.10, <=3.2.1)

php-parser NPM version =0.0.10, =0.1.53, =0.0.1, =0.0.2, =5.4.5, =0.8.0, =1.0.0, =1.2.2, =1.0.5, =0.0.2, =1.0.83, =1.1.17, =1.1.38 and more Source cves: CVE-2024-57071 Source advisory: MEND:CVE-2024-57071...

CVE-2024-57071: Improperly Controlled Modification of Object Prototype Attributes

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-57071

A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...

CVE-2024-9546

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546: Exposure of Sensitive Information to an Unauthorized Actor

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546 WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546 WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure

The WPIDE – File Manager & Code Editor plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.9. This is due to the plugin utilizing the PHP-Parser library, which outputs parser rebuild command execution results. This makes it possible for...

CVE-2024-9546

CVE-2024-9546 affects the WPIDE – File Manager & Code Editor WordPress plugin (versions up to and including 3.4.9). The issue is an Unauthenticated Full Path Disclosure caused by the plugin’s use of the PHP-Parser library, which outputs parser rebuild command results. The disclosed information ca...