4737 matches found
CVE-2023-3543
A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/firstname/secondname/address1/country leads to...
oauth2-server 安全漏洞
oauth2-server is a standards-compliant implementation of OAuth 2.0 authorization server written in PHP for individual developers . Provides authentication and authorization capabilities for applications to secure APIs. A security vulnerability exists in oauth2-server versions prior to 8.3.2 throu...
USN-6199-1: PHP vulnerability
It was discovered that PHP incorrectly handled certain Digest authentication for SOAP. An attacker could possibly use this issue to expose sensitive information...
F5 Networks BIG-IP : PHP vulnerability (K000133753)
The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3 / 17.5.1. It is, therefore, affected by a vulnerability as referenced in the K000133753 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload...
PT-2023-11582 · Wuzhicms · Wuzhi Cms
Name of the Vulnerable Software and Affected Versions: WUZHI CMS version 4.1.0 Description: An issue in the software allows a remote attacker to execute arbitrary code via the set chache method of the functioncommon.func.php file. Recommendations: For WUZHI CMS version 4.1.0, consider disabling t...
PHP 安全特征问题漏洞
PHP is a scripting language that executes on the server side. A security vulnerability exists in PHP versions 7.3.31-1deb10u4, which stems from incorrect SOAP HTTP Digest authentication, which could lead to stack information leakage...
CVE-2023-3310
A vulnerability, which was classified as critical, has been found in code-projects Agro-School Management System 1.0. Affected by this issue is some unknown functionality of the file loaddata.php. The manipulation of the argument subject/course leads to sql injection. The attack may be launched...
Design/Logic Flaw
An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file...
PT-2023-5269 · Php +10 · Php +10
Name of the Vulnerable Software and Affected Versions: PHP versions 8.0. through 8.0.28 PHP versions 8.1. through 8.1.19 PHP versions 8.2. through 8.2.6 Description: The issue is related to the use of a random value generator with a narrower range of values than it should have when using SOAP HTT...
Deserialization of untrusted data
The Otter WordPress plugin before 2.2.6 does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP 8.0 using the phar:// stream wrapper...
K000134747: PHP vulnerability CVE-2023-0568
Security Advisory Description In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, core path resolution function allocate buffer one byte too small. When resolving paths with lengths close to system MAXPATHLEN setting, this may lead to the byte after the allocated buffer being...
CVE-2023-31707
SEMCMS 1.5 is vulnerable to SQL Injection via AntRponse.php...
ReactPHP's HTTP server continues parsing unused multipart parts after reaching input field and file upload limits
Summary Previous versions of ReactPHP's HTTP server component contain a potential DoS vulnerability that can cause high CPU load when processing large HTTP request bodies. This vulnerability has little to no impact on the default configuration, but can be exploited when explicitly using the...
php: standard insecure cookie could be treated as a '__Host-' or '__Secure-' cookie by PHP applications
A vulnerability was found in PHP due to the way PHP handles HTTP variable names. It interferes with HTTP variable names that clash with ones that have a specific semantic meaning. This vulnerability allows network and same-site attackers to set a standard insecure cookie in the victim's browser,...
CVE-2023-2551 PHP Remote File Inclusion in unilogies/bumsys
PHP Remote File Inclusion in GitHub repository unilogies/bumsys prior to 2.1.1...
USN-6053-1 php7.0 vulnerability
It was discovered that PHP incorrectly handled certain invalid Blowfish password hashes. An invalid password hash could possibly allow applications to accept any password as valid, contrary to expectations...
Otter - Gutenberg Blocks < 2.2.6 - Author+ PHAR Deserialization
The plugin does not sanitize some user-controlled file paths before performing file operations on them. This leads to a PHAR deserialization vulnerability on PHP addFromString'test.png', 'text'; $phar-setStub"\xff\xd8\xff\n"; $phar-setMetadatanew Evil; $phar-stopBuffering; 2. As an Author user,...
PT-2023-17249 · Sourcecodester · Sourcecodester Simple Task Allocation System
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Task Allocation System version 1.0 Description: A critical issue has been found in the manage user.php file, where the manipulation of the id argument leads to sql injection. This issue can be exploited remotely. The...
CVE-2023-1737
A vulnerability, which was classified as critical, was found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. This affects an unknown part of the file login.php. The manipulation of the argument UUSERNAME leads to sql injection. It is possible to initiate the attack remotely. The...
