Login Request a demo
PH
Vendor
PHP
27 products with CVEs on record
787
CVEs
8
On KEV
4
New 30D
Products
PH
PHP
Language
9.8
750 CVEs6 on KEV4 new
AT
Archive Tar
Php
7.8
4 CVEs2 on KEV0 new
PE
Pear
Php
7.5
5 CVEs0 on KEV0 new
BC
Best Courier Management System
Php
9.8
2 CVEs0 on KEV0 new
FR
Frankenphp
Php
9.8
2 CVEs0 on KEV0 new
PE
Pearweb
Php
9.8
2 CVEs0 on KEV0 new
PS
Php Script Index
Php
–
2 CVEs0 on KEV0 new
AS
Animated Smiley Generator
Php
–
1 CVEs0 on KEV0 new
AM
AR Memberscript
Php
–
1 CVEs0 on KEV0 new
BH
Best House Rental Management System
Php
9.8
1 CVEs0 on KEV0 new
BC
Blog Cms
Php
–
1 CVEs0 on KEV0 new
BL
Bloq
Php
–
1 CVEs0 on KEV0 new
CE
Com Extensions
Php
–
1 CVEs0 on KEV0 new
DL
Directory Listing Script
Php
–
1 CVEs0 on KEV0 new
ER
Errordocs
Php
–
1 CVEs0 on KEV0 new
EX
Ext-http
Php
9.8
1 CVEs0 on KEV0 new
FM
F1 Maxs File Uploader
Php
–
1 CVEs0 on KEV0 new
IM
Imagick
Php
9.8
1 CVEs0 on KEV0 new
ME
Memcached
Php
9.8
1 CVEs0 on KEV0 new
MB
Mysql Banner Exchange
Php
–
1 CVEs0 on KEV0 new
ME
Mysql Extension
Php
–
1 CVEs0 on KEV0 new
PA
Pear Archive Tar
Php
8.8
1 CVEs0 on KEV0 new
PH
Pecl Http
Php
9.8
1 CVEs0 on KEV0 new
PF
Php FI
Php
–
1 CVEs0 on KEV0 new
PH
Phpsquidpass
Php
–
1 CVEs0 on KEV0 new
XH
Xhprof
Php
–
1 CVEs0 on KEV0 new
XR
Xml Rpc
Php
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-109619
In wildKEV
PH
PHP
PHP
8.1
100%
Oct 21RCE via stale global state
CVE-2026-109618
In wildKEV
PH
PHP
PHP
9.8
100%
Oct 21RCE via OOM corruption
CVE-2026-85733
PH
PHP
PHP
5.3
0%
Oct 13FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables
CVE-2026-82416
PH
PHP
PHP
7.7
0%
Oct 13FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
CVE-2026-92842
PH
PHP
PHP
5.9
0%
Sep 25OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
CVE-2026-91768
PH
PHP
PHP
6.5
0%
Sep 25IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
CVE-2026-91769
PH
PHP
PHP
4.3
0%
Sep 25TLS Hostname Verification Falls Back to CN After SAN Mismatch
CVE-2026-91767
PH
PHP
PHP
6.5
0%
Sep 25Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
CVE-2025-1218
PH
PHP
PHP
5.9
0%
Sep 25Various packet overreads in mysqlnd_writeprotocol.c
CVE-2026-91766
PH
PHP
PHP
5.9
0%
Sep 25Cross-origin credential leak in HTTP stream wrapper redirects
CVE-2026-91765
PH
PHP
PHP
7.5
0%
Sep 25SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
CVE-2025-14181
PH
PHP
PHP
6.5
0%
Sep 25Integer overflow to buffer overflow in soap HTTP parsing
CVE-2026-17545
PH
PHP
PHP
7.5
0%
Sep 25PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
CVE-2026-6103
PH
PHP
PHP
3.3
0%
Sep 25Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
CVE-2026-93682
PH
PHP
PHP
5.8
0%
Sep 25Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
CVE-2026-7260
PH
PHP
PHP
5.5
0%
Jul 30Stack overflow in phar with circular symlinks
CVE-2026-17544
PH
PHP
PHP
9.8
0%
Jul 30Out-of-bounds write in bccomp() via crafted operand and scale
CVE-2026-17543
PH
PHP
PHP
9.8
0%
Jul 30SQL injection in ext-pgsql via E'...' backslash breakout
CVE-2026-14355
PH
PHP
PHP
5.3
0%
Jul 3ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD
CVE-2026-45062
PH
PHP
PHP
8.1
1%
Jun 10FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files
CVE-2026-7263
PH
PHP
PHP
7.5
0%
May 10DoS attack via DOMNode::C14N()
CVE-2026-6104
PH
PHP
PHP
9.1
0%
May 10Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
CVE-2026-7258
PH
PHP
PHP
7.5
0%
May 10Out-of-bounds read in urldecode() on NetBSD
CVE-2026-6722
PH
PHP
PHP
9.8
1%
May 10Use-After-Free in SOAP using Apache map
CVE-2026-7259
PH
PHP
PHP
6.5
0%
May 10Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
CVE-2026-7261
PH
PHP
PHP
9.8
0%
May 10SoapServer session-persisted object use-after-free via SOAP header fault
CVE-2026-7262
PH
PHP
PHP
7.5
1%
May 10NULL pointer dereference in SOAP apache:Map decoder with missing <value>
CVE-2025-14179
PH
PHP
PHP
9.8
0%
May 10SQL injection in pdo_firebird via NUL bytes in quoted strings
CVE-2026-7568
PH
PHP
PHP
7.5
0%
May 10Signed integer overflow in metaphone()
CVE-2026-6735
PH
PHP
PHP
6.1
0%
May 10XSS within PHP-FPM status endpoint
CVE-2026-24895
PH
PHP
PHP
9.8
1%
Feb 12FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files
CVE-2026-24894
PH
PHP
PHP
7.5
0%
Feb 12FrankenPHP leaks session data between requests in worker mode
CVE-2025-14177
PH
PHP
PHP
7.5
1%
Dec 27Information Leak of Memory in getimagesize
CVE-2025-14178
PH
PHP
PHP
8.2
0%
Dec 27Heap buffer overflow in array_merge()
CVE-2025-14180
PH
PHP
PHP
7.5
1%
Dec 27NULL Pointer Dereference in PDO quoting
CVE-2025-1735
PH
PHP
PHP
7.5
1%
Jul 13pgsql extension does not check for errors during escaping
CVE-2025-1220
PH
PHP
PHP
5.3
1%
Jul 13Null byte termination in hostnames
CVE-2025-6491
PH
PHP
PHP
5.9
1%
Jul 13NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
CVE-2024-11235
PH
PHP
PHP
8.1
1%
Apr 4Reference counting in php_request_shutdown causes Use-After-Free
CVE-2025-1861
PH
PHP
PHP
9.8
1%
Mar 30Stream HTTP wrapper truncates redirect location to 1024 bytes
CVE-2025-1736
PH
PHP
PHP
7.3
1%
Mar 30Stream HTTP wrapper header check might omit basic auth header
CVE-2025-1734
PH
PHP
PHP
5.3
1%
Mar 30Streams HTTP wrapper does not fail for headers with invalid name and no colon
CVE-2025-1219
PH
PHP
PHP
5.3
1%
Mar 30libxml streams use wrong content-type header when requesting a redirected resource
CVE-2025-1217
PH
PHP
PHP
3.1
1%
Mar 29Header parser of http stream wrapper does not handle folded headers
CVE-2022-31631
PH
PHP
PHP
9.1
2%
Feb 12PDO::quote() may return unquoted string
CVE-2024-11233
PH
PHP
PHP
8.2
2%
Nov 24Single byte overread with convert.quoted-printable-decode filter
CVE-2024-11234
PH
PHP
PHP
7.2
1%
Nov 24Configuring a proxy in a stream context might allow for CRLF injection in URIs
CVE-2024-11236
PH
PHP
PHP
9.8
2%
Nov 24Integer overflow in the firebird and dblib quoters causing OOB writes
CVE-2024-8929
PH
PHP
PHP
5.8
2%
Nov 22Leak partial content of the heap through heap buffer over-read in mysqlnd
CVE-2024-8932
PH
PHP
PHP
9.8
1%
Nov 22OOB access in ldap_escape
CVE-2024-48579
BH
Best House Rental Management System
Php
9.8
1%
Oct 25SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username parameter of the login…
CVE-2024-48581
BC
Best Courier Management System
Php
9.8
1%
Oct 25File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_class.php component
CVE-2024-48580
BC
Best Courier Management System
Php
9.8
1%
Oct 25SQL Injection vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the email parameter of the login request
CVE-2024-9026
PH
PHP
PHP
3.3
0%
Oct 8In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output =…
CVE-2024-8927
PH
PHP
PHP
7.5
1%
Oct 8In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP…
CVE-2024-8926
PH
PHP
PHP
8.8
4%
Oct 8In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577…
CVE-2024-8925
PH
PHP
PHP
5.3
1%
Oct 8In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate…
CVE-2024-2408
PH
PHP
PHP
5.9
1%
Jun 9The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an…
CVE-2024-4577
RansomwareIn wildKEV
PH
PHP
PHP
9.8
100%
Jun 9Argument Injection in PHP-CGI
CVE-2024-5585
PH
PHP
PHP
8.8
29%
Jun 9In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces