https://vulnogram.org/ Most recent CVEs assigned by PHP Group (php). https://vulnogram.org/seaview/icons/php.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-92842 https://vulnogram.org/CVE-2026-92842 The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with… Medium Network Exploitable Fri, 25 Sep 2026 21:11:57 GMT https://vulnogram.org/CVE-2026-91768 https://vulnogram.org/CVE-2026-91768 The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96… Medium Fri, 25 Sep 2026 21:07:30 GMT https://vulnogram.org/CVE-2026-91769 https://vulnogram.org/CVE-2026-91769 PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so… Medium Fri, 25 Sep 2026 20:59:39 GMT https://vulnogram.org/CVE-2026-91767 https://vulnogram.org/CVE-2026-91767 php_openssl_matches_wildcard_name() in ext/openssl/xp_ssl.c underflows the length argument passed to memchr() when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A mali… Medium Fri, 25 Sep 2026 20:53:42 GMT https://vulnogram.org/CVE-2025-1218 https://vulnogram.org/CVE-2025-1218 The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the pa… Low Fri, 25 Sep 2026 20:48:21 GMT https://vulnogram.org/CVE-2026-91766 https://vulnogram.org/CVE-2026-91766 When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers unchanged, even when the redirect target is a different host, a different port, or a downgrade from HTTPS to HTTP.… Medium Network Exploitable Fri, 25 Sep 2026 20:40:25 GMT https://vulnogram.org/CVE-2026-91765 https://vulnogram.org/CVE-2026-91765 cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and c… High Network Exploitable Fri, 25 Sep 2026 20:33:03 GMT https://vulnogram.org/CVE-2025-14181 https://vulnogram.org/CVE-2025-14181 The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client a… Medium Network Exploitable Fri, 25 Sep 2026 20:26:45 GMT https://vulnogram.org/CVE-2026-17545 https://vulnogram.org/CVE-2026-17545 On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches C… Medium Network Exploitable Fri, 25 Sep 2026 20:18:11 GMT https://vulnogram.org/CVE-2026-6103 https://vulnogram.org/CVE-2026-6103 phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong num… Medium Fri, 25 Sep 2026 20:08:49 GMT https://vulnogram.org/CVE-2026-93682 https://vulnogram.org/CVE-2026-93682 When the HTTP stream wrapper follows a redirect and the response carries a Location header with an empty value, the redirect code reads one byte past the end of the heap buffer holding the location. The value of that out-of-bounds byte decides which… Medium Network Exploitable Fri, 25 Sep 2026 20:02:11 GMT https://vulnogram.org/CVE-2026-7260 https://vulnogram.org/CVE-2026-7260 Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9… Medium Thu, 30 Jul 2026 11:22:53 GMT https://vulnogram.org/CVE-2026-17544 https://vulnogram.org/CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9. High Network Exploitable Thu, 30 Jul 2026 11:22:24 GMT https://vulnogram.org/CVE-2026-17543 https://vulnogram.org/CVE-2026-17543 Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9. High Network Exploitable Thu, 30 Jul 2026 11:22:04 GMT https://vulnogram.org/CVE-2026-14355 https://vulnogram.org/CVE-2026-14355 In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding o… Medium Network Exploitable Fri, 03 Jul 2026 20:57:31 GMT https://vulnogram.org/CVE-2026-7263 https://vulnogram.org/CVE-2026-7263 In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the X… High Network Exploitable Sun, 10 May 2026 04:43:04 GMT https://vulnogram.org/CVE-2026-6104 https://vulnogram.org/CVE-2026-6104 In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it mean… High Network Exploitable Sun, 10 May 2026 04:35:17 GMT https://vulnogram.org/CVE-2026-7258 https://vulnogram.org/CVE-2026-7258 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized… Medium Network Exploitable Sun, 10 May 2026 04:28:14 GMT https://vulnogram.org/CVE-2026-6722 https://vulnogram.org/CVE-2026-6722 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. Whe… Critical Network Exploitable Sun, 10 May 2026 04:19:15 GMT https://vulnogram.org/CVE-2026-7259 https://vulnogram.org/CVE-2026-7259 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of servic… Low Network Exploitable Sun, 10 May 2026 04:13:26 GMT https://vulnogram.org/CVE-2026-7261 https://vulnogram.org/CVE-2026-7261 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the c… Medium Network Exploitable Sun, 10 May 2026 04:07:25 GMT https://vulnogram.org/CVE-2026-7262 https://vulnogram.org/CVE-2026-7262 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value eleme… High Network Exploitable Sun, 10 May 2026 04:00:09 GMT https://vulnogram.org/CVE-2025-14179 https://vulnogram.org/CVE-2025-14179 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containin… High Network Exploitable Sun, 10 May 2026 03:51:14 GMT https://vulnogram.org/CVE-2026-7568 https://vulnogram.org/CVE-2026-7568 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string… High Network Exploitable Sun, 10 May 2026 03:42:36 GMT https://vulnogram.org/CVE-2026-6735 https://vulnogram.org/CVE-2026-6735 In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS… High Network Exploitable Sun, 10 May 2026 03:27:00 GMT https://vulnogram.org/CVE-2025-14177 https://vulnogram.org/CVE-2025-14177 In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-ch… Medium Network Exploitable Sat, 27 Dec 2025 19:33:23 GMT https://vulnogram.org/CVE-2025-14178 https://vulnogram.org/CVE-2025-14178 In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE,… Medium Network Exploitable Sat, 27 Dec 2025 19:27:41 GMT https://vulnogram.org/CVE-2025-14180 https://vulnogram.org/CVE-2025-14180 In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a pre… High Network Exploitable Sat, 27 Dec 2025 19:21:20 GMT https://vulnogram.org/CVE-2025-1735 https://vulnogram.org/CVE-2025-1735 In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the stri… Medium Network Exploitable Sun, 13 Jul 2025 22:27:48 GMT https://vulnogram.org/CVE-2025-1220 https://vulnogram.org/CVE-2025-1220 In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 some functions like fsockopen() lack validation that the hostname supplied does not contain null characters. This may lead to other functions like pars… Low Network Exploitable Sun, 13 Jul 2025 22:18:36 GMT https://vulnogram.org/CVE-2025-6491 https://vulnogram.org/CVE-2025-6491 In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* before 8.4.10 when parsing XML data in SOAP extensions, overly large (>2Gb) XML namespace prefix may lead to null pointer dereference. This may lead to crashes and a… Medium Network Exploitable Sun, 13 Jul 2025 22:10:15 GMT https://vulnogram.org/CVE-2024-11235 https://vulnogram.org/CVE-2024-11235 In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for examp… Critical Network Exploitable Fri, 04 Apr 2025 17:51:07 GMT https://vulnogram.org/CVE-2025-1861 https://vulnogram.org/CVE-2025-1861 In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of… Medium Network Exploitable Sun, 30 Mar 2025 05:57:57 GMT https://vulnogram.org/CVE-2025-1736 https://vulnogram.org/CVE-2025-1736 In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent o… Medium Network Exploitable Sun, 30 Mar 2025 05:49:14 GMT https://vulnogram.org/CVE-2025-1734 https://vulnogram.org/CVE-2025-1734 In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may con… Medium Network Exploitable Sun, 30 Mar 2025 05:43:35 GMT https://vulnogram.org/CVE-2025-1219 https://vulnogram.org/CVE-2025-1219 In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when t… Medium Network Exploitable Sun, 30 Mar 2025 05:33:13 GMT https://vulnogram.org/CVE-2025-1217 https://vulnogram.org/CVE-2025-1217 In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreti… Medium Network Exploitable Sat, 29 Mar 2025 05:19:33 GMT https://vulnogram.org/CVE-2022-31631 https://vulnogram.org/CVE-2022-31631 In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may furthe… Critical Network Exploitable Wed, 12 Feb 2025 22:10:45 GMT https://vulnogram.org/CVE-2024-11233 https://vulnogram.org/CVE-2024-11233 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or discl… Medium Network Exploitable Sun, 24 Nov 2024 01:08:28 GMT https://vulnogram.org/CVE-2024-11234 https://vulnogram.org/CVE-2024-11234 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to… Medium Network Exploitable Sun, 24 Nov 2024 00:57:39 GMT https://vulnogram.org/CVE-2024-11236 https://vulnogram.org/CVE-2024-11236 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write. Critical Network Exploitable Sun, 24 Nov 2024 00:44:54 GMT https://vulnogram.org/CVE-2024-8929 https://vulnogram.org/CVE-2024-8929 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different user… Medium Fri, 22 Nov 2024 06:15:29 GMT https://vulnogram.org/CVE-2024-8932 https://vulnogram.org/CVE-2024-8932 In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write. Critical Network Exploitable Fri, 22 Nov 2024 06:03:29 GMT https://vulnogram.org/CVE-2024-9026 https://vulnogram.org/CVE-2024-9026 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 char… Low Tue, 08 Oct 2024 04:07:33 GMT https://vulnogram.org/CVE-2024-8927 https://vulnogram.org/CVE-2024-8927 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can b… High Network Exploitable Tue, 08 Oct 2024 03:56:31 GMT https://vulnogram.org/CVE-2024-8926 https://vulnogram.org/CVE-2024-8926 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed… High Network Exploitable Tue, 08 Oct 2024 03:48:53 GMT https://vulnogram.org/CVE-2024-8925 https://vulnogram.org/CVE-2024-8925 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to… Low Tue, 08 Oct 2024 03:35:02 GMT https://vulnogram.org/CVE-2024-2408 https://vulnogram.org/CVE-2024-2408 The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https:… Medium Network Exploitable Sun, 09 Jun 2024 19:55:51 GMT https://vulnogram.org/CVE-2024-4577 https://vulnogram.org/CVE-2024-4577 In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given… Critical Known Exploited Network Exploitable Sun, 09 Jun 2024 19:42:36 GMT https://vulnogram.org/CVE-2024-5585 https://vulnogram.org/CVE-2024-5585 In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient… High Network Exploitable Sun, 09 Jun 2024 18:36:50 GMT