110186 matches found
php: PHP: Denial of Service via heap buffer overflow in SOAP client
A flaw was found in PHP. A malicious server can cause a Denial of Service DoS by exploiting an improper buffer size check in the Simple Object Access Protocol SOAP client during HTTP response parsing. When responding to a request, the server can supply crafted data that triggers an integer...
php: PHP: Archive entry injection via integer overflow in TAR parser
A flaw was found in PHP. An integer overflow vulnerability in the Phar extension occurs when parsing TAR archive headers containing excessively large size fields. An attacker can exploit this issue by supplying a specially crafted archive file to an application that processes TAR archives, causin...
php: php: Credential disclosure via cross-origin HTTP redirects
A flaw was found in PHP. When following a redirect, the built-in HTTP Hypertext Transfer Protocol stream wrapper forwards sensitive request headers—such as authentication tokens and session cookies—unchanged, even when directed to a different host, port, or unencrypted connection. A malicious...
php: php: Information disclosure via crafted TLS server certificate
A flaw was found in PHP. When validating secure connections using Transport Layer Security TLS, an error in how wildcard domain names in server certificates are verified can lead to an out-of-bounds memory read. A malicious server presenting a specially crafted certificate can exploit this issue...
php: php: Server impersonation via Common Name fallback in TLS verification
A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...
php: php: Information disclosure via out-of-bounds read in stream filters
A flaw was found in PHP. When processing certain conversion stream filters with line-break settings containing a null byte, the filter duplicates the string but retains the original length rather than the truncated size. An attacker who can influence filter options could exploit this out-of-bound...
php: php: Out-of-bounds read via empty HTTP redirect Location header
A flaw was found in PHP. When the HTTP stream wrapper processes a redirect response containing an empty Location header, an out-of-bounds read occurs by accessing memory beyond the allocated buffer. A malicious server can exploit this flaw to influence the client's redirect target path, potential...
php: php: Denial of Service via unbounded recursion in SOAP parser
A flaw was found in PHP. An unauthenticated remote attacker could cause a Denial of Service DoS by sending a specially crafted request to an affected Simple Object Access Protocol SOAP server endpoint. Due to a lack of recursion depth limits when parsing deeply nested XML elements, processing suc...
php: php: Access control bypass via partial IPv6 address comparison
A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...
WordPress Ninja Forms plugin 3.15.3 - Unauthenticated PHP Object Injection vulnerability
Unauthenticated PHP Object Injection vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Ninja Forms versions 3.15.3...
CVE-2026-75799
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...
EUVD-2026-85024
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...
Exploit for CVE-2026-87902
CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-tra...
CVE-2026-95603: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...
CVE-2026-75799: Improper Control of Generation of Code
The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate the type of the remote files it caches in a publicly accessible directory, allowing unauthenticated attackers to write arbitrary PHP files on the server and achieve RCE when the relevant feature is enabled...
CVE-2026-63000: Cross-Site Request Forgery (CSRF)
REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...
WordPress 7.1.1 Local File Inclusion Scanner
WordPress versions 4.7.0 through 7.1.1 contain an unauthenticated page-template path traversal issue that can include readable local PHP files. This tool probes the wp-links-opml.php inclusion oracle without attempting command execution...
PT-2026-97518
Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description Sulu is an open-source PHP content management system based on the Symfony framework. A JCR-SQL2 injection exists in the Smart Content QueryBuilder within...
SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4288-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4288-1 advisory. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. Tenable has...