110510 matches found
PHPCGIScanner
PHP CGI Scanner Screenshot Overview PHP CGI Scanner is a Python 3 utility designed to help identify systems potentially exposed to CVE-2024-4577. It checks for visible PHP versions, common CGI endpoints, and phpinfo outputs to provide a quick risk assessment. Disclaimer: This tool is for authoriz...
CVE-2026-84192
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...
EUVD-2026-69030
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...
CVE-2026-84193 LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...
CVE-2026-84193 LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...
CVE-2026-84192
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP interface descriptions and syslog program fields without proper escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript that executes when aut...
EUVD-2026-69029
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...
CVE-2026-84192 LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...
php: ext-pgsql: PHP: SQL injection via improper backslash escaping
A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...
php: PHP: Denial of Service via circular symbolic links in phar archives
A flaw was found in PHP. When processing a specially crafted PHP Archive phar file containing circular symbolic links, the PHP process can enter an uncontrolled loop. This unbounded recursion exhausts the program's memory stack, causing the PHP application to crash. This vulnerability could allow...
Important: Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update
An update for the php:8.2 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Exploit for Deserialization of Untrusted Data in Spip
CVE-2026-27475 CVSS-B 9.2 CRITICAL Authenticated Insecur...
WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability
WordPress Ninja Forms - Layout & Styles plugin = 3.0.31 - PHP Object Injection vulnerability discovered by Marc-André Beaulieu h3dg3h0g in WordPress Plugin Ninja Forms - Layout & Styles versions = 3.0.31...
WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin WP User Frontend versions = 4.3.10...
PT-2026-84156
LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...
PT-2026-84155
LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...
ROS-20260901-73-0006
The vulnerability of the urldecode function in the PHP programming language is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
ROS-20260901-73-0005
The vulnerability of the urldecode function in the PHP programming language is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
PT-2026-84455
Name of the Vulnerable Software and Affected Versions phpseclib versions prior to 3.0.57 phpseclib versions prior to 4.0.1 Description Pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in the add and subtract...
ALSA-2026:61903 Important: php:8.2 security, bug fix, and enhancement update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...