PT-2026-123310

An insecure deserialization PHP object injection vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of usin...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain request-handling memory-corruption flaws. This proof of concept uses multipart upload progress handling to demonstrate remote code execution. https://packetstorm.news/download/237644...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions through 8.5.11 contain memory-corruption flaws that can allow unauthenticated remote code execution. This proof of concept uses crafted multipart upload-progress requests to trigger the vulnerability chain. https://packetstorm.news/download/237643...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146102)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146102 advisory. PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after bei...

PHP Session Upload Progress Exposure Checker

A command-line tool that checks PHP configuration and application code for exposure to the session upload progress vulnerability, including the required serialize handler, runtime iniset, and upload progress conditions...

PHP 8.5.11 Remote Code Execution Vulnerability Checker

PHP versions before 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain two vulnerabilities that may allow unauthenticated remote code execution. This tool checks a PHP version string for affected upstream releases and specific Ubuntu backports...

Amazon Linux Unpatched Vulnerability : CVE-2026-109618

The remote Amazon Linux host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for...

PHP 8.5.11 Session Upload Progress Remote Code Execution

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain an OOM-driven session upload progress use-after-free that can lead to unauthenticated remote code execution. Includes a Python proof of concept for Apache modphp. https://packetstorm.news/download/237652...

VulnCheck KEV: CVE-2025-26986

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in StylemixThemes Pearl - Corporate Business pearl allows PHP Local File Inclusion.This issue affects Pearl - Corporate Business: from n/a through 3.4.8...

CloudClassroom PHP Project cross-site scripting vulnerability

The CloudClassroom PHP project contains a security vulnerability stemming from improper handling of the fname parameter in the addnewstudent.php file. This vulnerability may lead to cross-site scripting attacks, which can be carried out remotely...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146096)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146096 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: php (UTSA-2026-146098)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146098 advisory. PHP uses longjmp for out-of-memory OOM errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario...

Tenable Security Center Multiple Vulnerabilities (TNS-2026-30)

According to its self-reported version, the Tenable Security Center running on the remote host is 6.9.1 or earlier and missing security patch SC-202610.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-30 advisory. - PHP uses longjmp for out-of-memory OOM...

PHP Session Upload Progress Enabled Detection

This template detects PHP targets with session.uploadprogress enabled, a required precondition for CVE-2026-115560. It also checks exposed phpinfo pages for the setting and session serialize handler...

PHP Memory Corruption Vulnerability

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell behind nginx Measurements, a lab, and an app-level...

CVE-2026-116097 CloudClassroom-PHP-Project addnewstudent.php cross site scripting

A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

CVE-2026-116097

The CloudClassroom-PHP-Project contains a cross-site scripting (XSS) vulnerability within the addnewstudent.php file. The root cause is the improper neutralization of input when processing the fname argument. This vulnerability can be exploited remotely to execute scripts in a user's browser. Whi...

CVE-2026-116097 CloudClassroom-PHP-Project addnewstudent.php cross site scripting

A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

CVE-2024-4577

Nuclei Template for CVE-2024-4577 This Nuclei template serves as a Proof of Concept PoC for CVE-2024-4577, a PHP CGI Argument Injection vulnerability. Example Command nuclei -t CVE-2024-4577.yaml -u https://example.com...