PHP CGI SAPI Pointer Underflow Remote Code Execution

PHP versions 5.x through 8.4.26 are reported to contain a pointer underflow vulnerability in the CGI SAPI when cgi.fixpathinfo is enabled. A missing bounds check during PATHINFO processing can result in out-of-bounds memory access, potentially allowing heap information disclosure, an ASLR bypass,...

PHP Session Serialization Desynchronization Remote Code Execution

PHP web applications that dynamically switch session serialization handlers between phpserialize and php may be susceptible to session desynchronization and injection attacks. An unauthenticated attacker can abuse the PHPSESSIONUPLOADPROGRESS mechanism to inject specially crafted session data tha...

TencentOS Server 3: php:8.2 (TSSA-2026:1209)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1209 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Semantic MediaWiki resource management error vulnerability

Versions of Semantic MediaWiki from 3.0.0 up to but not including 7.3.1 contain a resource management vulnerability. This vulnerability stems from an algorithm complexity issue in TermParser::normalizecompactform. Unauthenticated attackers can exploit this by submitting long search queries...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions through 8.5.11 contain session.uploadprogress OOM-corruption and stale-global-state vulnerabilities that can lead to remote code execution. Included is a proof of concept with passive fingerprinting and local Docker lab support. https://packetstorm.news/download/237904...

PT-2026-127859

Name of the Vulnerable Software and Affected Versions Contact Manager versions prior to 9.1.3 Description An arbitrary file upload issue exists in the add message function. This occurs because an incomplete extension blacklist fails to detect dangerous extensions when a trailing dot causes the...

PT-2026-126375

svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg replace...

PT-2026-127253

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as ldap filter, poisoning /personnalisation/config ldap.inc.php and permitting remote code...

WordPress Kirki deserialization injection vulnerability

WordPress Kirki versions 6.2.5 and earlier contain a deserialization injection vulnerability. This flaw stems from a lack of permission checks in the ‘get-single-symbol’ branch of the kirkipostapis AJAX scheduler. Untrusted input can be deserialized, leading to PHP object injection. Attackers wit...

PT-2026-125883

The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the kirki post apis AJAX dispatcher due to a missing capability check. This...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146118)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146118 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146121)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146121 advisory. In PHP versions 8.2. before 8.2.32, 8.3. before 8.3.32, 8.4. before 8.4.23, 8.5. before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contain...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146119 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

CVE-2026-117515: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e0635. Impacted is an unknown function of the file traceapplication.php. The manipulation of the argument Search results in sql injection. It is possible to launch the attack remotely. The...

PT-2026-126688

A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customer search.php of the component Admin Search Pages. Executing a manipulation of the argument customer name/voucher no/emp name can lead to sql injection. The attack...

PT-2026-127184

A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146117)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146117 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

CVE-2026-117513: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/customersearch.php of the component Admin Search Pages. Executing a manipulation of the argument customername/voucherno/empname can lead to sql injection. The attack may...

CVE-2026-117516: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contactinsert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be...

CVE-2026-117512: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/employeeinsert.php. Performing a manipulation of the argument employee photo results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made...