php: ext-pgsql: PHP: SQL injection via improper backslash escaping

A flaw was found in PHP. Improper escaping of backslashes in attacker-provided parameters can lead to a SQL injection vulnerability. A remote attacker could exploit this flaw by crafting malicious input, potentially gaining unauthorized access to sensitive information, manipulating data, or causi...

Important: Red Hat Security Advisory: php:8.2 security, bug fix, and enhancement update

An update for the php:8.2 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Exploit for Deserialization of Untrusted Data in Spip

CVE-2026-27475 CVSS-B 9.2 CRITICAL Authenticated Insecur...

WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability

WordPress Ninja Forms - Layout & Styles plugin = 3.0.31 - PHP Object Injection vulnerability discovered by Marc-André Beaulieu h3dg3h0g in WordPress Plugin Ninja Forms - Layout & Styles versions = 3.0.31...

WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by VanTastic in WordPress Plugin WP User Frontend versions = 4.3.10...

PHP mb_* Functions

The vulnerability of the functions mbconvertencoding, mbdetectencoding, mbconvertvariables, and mbdetectorder in the PHP interpreter is related to reading beyond the buffer boundaries. Exploiting this vulnerability can allow a malicious actor to cause an unexpected termination of the application...

ROS-20260901-73-0011

The vulnerability of the PDO driver for the Firebird database management system, which is written in the PHP programming language, relates to the lack of protective measures taken against the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute SQL injections...

ROS-20260901-73-0008

The vulnerability in PHP is related to the assignment of a null pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260901-73-0004

The vulnerability of the urldecode function in the PHP programming language is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

SPIP 4.4.8 Insecure Deserialization

SPIP versions 4.4.0 through 4.4.8 contain an insecure deserialization vulnerability in the public area through the tablevaleur filter and DATA iterator. An attacker able to place malicious serialized content can trigger arbitrary object instantiation and potentially achieve remote code execution...

ROS-20260901-73-0026

The vulnerability in php-phpseclib is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to perform SSRF attacks remotely...

CVE-2026-84372: Improper Neutralization of CRLF Sequences

Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write by splitting it with...

CVE-2026-71981: Deserialization of Untrusted Data

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-84193: Improper Neutralization of Input During Web Page Generation

LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enro...

CVE-2026-84192: Improper Neutralization of Input During Web Page Generation

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...

PT-2026-84465

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payloa...

ALSA-2026:61903 Important: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...

ROS-20260901-73-0001

The vulnerability of the SoapServer class in the PHP programming language is related to the use of memory after it is freed during the processing of the SOAPPERSISTENCESESSION parameter. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information or cause service...

ROS-20260901-73-0009

The vulnerability in PHP is related to the assignment of a null pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-84155

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog...