4737 matches found
Denial Of Service (DoS)
php is vulnerable to denial of service DoS. The vulnerability exists as a bug in the PHP Streams component caused the PHP interpreter to crash if an FTP wrapper connection was made through an HTTP proxy. A remote attacker could possibly trigger this issue if a PHP script accepted an untrusted URL...
Denial Of Service (DoS)
php is vulnerable to denial of service DoS. The vulnerability exists as it was discovered that the PHP fnmatch function did not restrict the length of the pattern argument. A remote attacker could use this flaw to crash the PHP interpreter where a script used fnmatch on untrusted matching pattern...
Cross-Site Scripting (XSS)
php is vulnerable to denial of service. It was discovered that PHP did not limit the maximum number of files that can be uploaded in one request. A remote attacker could use this flaw to instigate a denial of service by causing the PHP interpreter to use lots of system resources dealing with...
CRLF Injection
php is vulnerable to CRLF injection. A flaw was discovered in the way PHP's mail function processed header data. If a script sent mail using a Subject header containing a string from an untrusted source, a remote attacker could send bulk e-mail to unintended recipients...
CVE-2020-7066
In PHP versions 7.2.x below 7.2.29, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using getheaders with user-supplied URL, if the URL contains zero \0 character, the URL will be silently truncated at it. This may cause some software to make incorrect assumptions about the target of the getheade...
WP Advanced Search < 3.3.6 - Unauthenticated SQL Injection
Due to using string concatenation, allowing direct access to a vulnerable PHP file and missing best-practices for coding SQL operations, there exists an unauthenticated SQL injection in autocompletion-PHP5.5.php. After a month of trying to contact the Plugin author Twitter, email, we followed...
CVE-2020-7065
In PHP versions 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while using mbstrtolower function with UTF-32LE encoding, certain invalid strings could cause PHP to overwrite stack-allocated buffer. This could lead to memory corruption, crashes and potentially code execution...
SQL injection vulnerability in cl***.php page of website building system of Hubei Guosheng Technology Co.
Ltd. is a full-network value marketing service provider, to provide customers with comprehensive digital innovation services, to help traditional enterprises to realize the "Internet +" transformation and upgrading. There is a SQL injection vulnerability in the cl.php page of the website building...
PT-2020-2040 · Php +7 · Php +7
Name of the Vulnerable Software and Affected Versions: PHP versions 7.3.x below 7.3.16 PHP versions 7.4.x below 7.4.4 Description: The issue is related to the use of the mb strtolower function with UTF-32LE encoding in PHP. Certain invalid strings could cause PHP to overwrite the stack-allocated...
PT-2020-2412 · Php +8 · Php +8
Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x through 7.2.28 PHP versions 7.3.x through 7.3.15 PHP versions 7.4.x through 7.4.3 Description: The issue is related to the implementation of the get headers function in PHP, which does not properly check user-supplied URLs...
Chadha Software Technologies PHPKB Standard Multi-Language article.php Cross-Site Scripting Vulnerability
Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A cross-site scripting vulnerability exists in the way the Referer header is handled in the article.php file in Chadha Software...
SQL injection vulnerability in de***.php file of website building system of Beijing Shenghui Youlian Network Technology Co.
Beijing Shenghui Youlian Network Technology Co., Ltd. is a professional website construction organization in Beijing. A SQL injection vulnerability exists in the de.php file of the website building system of Beijing Shenghui Youlian Network Technology Co. An attacker can use the vulnerability to...
LiveZilla Live Chat Elevation of Privilege Vulnerability
LiveZilla Live Chat is a free online customer service system from the German company LiveZilla. The system provides real-time monitoring of visitors, offline messages, GeoTracking map tracking, access statistics, online chat and other features. A security vulnerability exists in the 'name' functi...
SQL Injection Vulnerability in in***.php of Longcai Technology Group Co.
Longcai Technology Group Limited Liability Company is a company dedicated to the development and construction of the Internet enterprise wisdom cloud service platform, and "Internet + industry innovation" platform services. Longcai Technology Group Limited Liability Company building system in.php...
CVE-2020-7063
In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when creating PHAR archive using PharData::buildFromIterator function, the files are added with default permissions 0666, or all access even if the original files on the filesystem were with more restrictive permissions...
Internet Bug Bounty: PHP link() silently truncates after a null byte on Windows
The bug submitted at: https://bugs.php.net/bug.php?id=78862 The security advisory at: https://nvd.nist.gov/vuln/detail/CVE-2019-11044 The issue allow remote attackers to read or write arbitrary files via crafted input to an application that calls the vulnerable function. As demonstrated by a...
SQL Injection Vulnerability in SemCMS SE***_Me***.php File
SemCMS is a set of open source foreign trade enterprise website management system, written in php language, can be run under window or linux system. SemCMS SEMe.php file SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive information in the database...
SemCMS SE***_In***.php file suffers from SQL injection vulnerability (CNVD-2020-18769)
SemCMS is a set of open source foreign trade enterprise website management system, written in php language, can be run under window or linux system. SemCMS SEIn.php file has a SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive information in the database...
PT-2020-2411 · Php +8 · Php +8
Name of the Vulnerable Software and Affected Versions: PHP versions 7.2.x below 7.2.9 PHP versions 7.3.x below 7.3.16 PHP versions 7.4.x below 7.4.4 Description: The issue is related to the exif read data function in PHP, which can cause the language to read one byte of uninitialized memory while...
