Oracle Linux 8 : php:7.4 (ELSA-2022-5467)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-5467 advisory. php 7.4.19-3 - fix password of excessive length triggers buffer overflow leading to RCE CVE-2022-31626 Tenable has extracted the preceding description block...

CLSA-2022-1656958778 Fixed CVEs in php-1.module_el8.5.0+2068+cc873159.tuxcare.els4: CVE-2022-31626, CVE-2022-31625

CVE-2022-31626: php: password of excessive length triggers buffer overflow leading to RCE - CVE-2022-31625: don't free uninitialized parameters that have led to RCE...

CLSA-2022-1656958574 Fixed CVEs in php-4.module_el8.4.0+2069+2eb69d76.tuxcare.els5: CVE-2022-31626, CVE-2022-31625

CVE-2022-31626: php: password of excessive length triggers buffer overflow leading to RCE - CVE-2022-31625: don't free uninitialized parameters that have led to RCE...

SUSE SLES12 Security Update : php72 (SUSE-SU-2022:2183-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2183-1 advisory. - In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying...

Critical PHP Vulnerability Exposes QNAP NAS Devices to Remote Attacks

QNAP, Taiwanese maker of network-attached storage NAS devices, on Wednesday said it's in the process of fixing a critical three-year-old PHP vulnerability that could be abused to achieve remote code execution. "A vulnerability has been reported to affect PHP versions 7.1.x below 7.1.33, 7.2.x bel...

QNAP QuTS hero RCE Vulnerability (QSA-22-20)

QNAP QuTS hero is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2022-33119

NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting XSS vulnerability via login.php...

PHP 安全漏洞

PHP is a scripting language that executes on the server side. A security vulnerability exists in PHP. No information about this vulnerability is available at this time, so stay tuned to CNNVD or the vendor announcement...

The vulnerability of the func2.php function in the web application for managing a medical institution, the PHPGurukul Hospital Management System, allows a perpetrator to disclose protected information.

The vulnerability of the func2.php function in the web application of the PHPGurukul Hospital Management System is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to disclose the protected information remotely...

CVE-2022-29720

74cmsSE v3.5.1 was discovered to contain an arbitrary file read vulnerability via the component \index\controller\Download.php...

Sql injection

A PHP injection vulnerability in Spip before v3.2.8 allows attackers to execute arbitrary PHP code via the oups parameter at /ecrire...

WordPress Advanced Image Sitemaps plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Advanced Image Sitemaps plugin 1.2 and earlier versions are vulnerable to a cross-site scripting...

CVE-2022-30776

atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter...

EUVD-2016-8331

Zend/zendexceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service infinite loop via a crafted Exception object in serialized data, a related issue to CVE-2015-8876...

CVE-2022-29656

Wedding Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Wedding-Management/packagedetail.php...

EUVD-2006-4519

PHP remote file inclusion vulnerability in lib/config.php in Pheap CMS 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lpref parameter...

EUVD-2006-4188

PHP remote file inclusion vulnerability in includes/session.php in Wheatblog wB 1.1 and earlier, when registerglobals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the wbclassdir parameter...

The vulnerability of the OpenSSL interpreter for the PHP programming language allows a hacker to trigger a service failure.

The vulnerability of the OpenSSL interpreter for the PHP programming language is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the syntactic analyzer of the SOAP interpreter for the PHP programming language allows attackers to exploit it to disclose protected information.

The vulnerability of the PHP programming language interpreter is related to the exposure of protected information. Exploiting this vulnerability allows an attacker, operating remotely, to compromise protected information through the SOAP WSDL file...

The vulnerability of the `process_nested_data` function in the PHP programming language allows a hacker to execute arbitrary code.

The vulnerability of the processnesteddata function in the PHP programming language is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...