Login Request a demo
TH
Vendor
Thinkphp
2 products with CVEs on record
28
CVEs
2
On KEV
0
New 30D
Products
TH
ThinkPHP
Thinkphp
9.8
27 CVEs1 on KEV0 new
NO
noneCms
ThinkPHP
9.8
1 CVEs1 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2018-25270
TH
ThinkPHP
Thinkphp
9.8
1%
Apr 22ThinkPHP 5.0.23 Remote Code Execution via invokefunction
CVE-2025-63889
TH
Thinkphp
Thinkphp
7.5
0%
Nov 20The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value
CVE-2025-63888
TH
Thinkphp
Thinkphp
9.8
1%
Nov 20The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability
CVE-2025-50707
TH
Thinkphp
Thinkphp
9.8
1%
Aug 5An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component
CVE-2025-50706
TH
Thinkphp
Thinkphp
9.8
1%
Aug 5An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function
CVE-2024-48112
TH
Thinkphp
Thinkphp
9.8
1%
Oct 30A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code
CVE-2024-44902
TH
Thinkphp
Thinkphp
9.8
4%
Sep 9A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code
CVE-2024-34467
TH
Thinkphp
Thinkphp
6.1
0%
May 4ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl
CVE-2022-45982
TH
Thinkphp
Thinkphp
9.8
1%
Feb 8thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability
CVE-2022-47945
TH
Thinkphp
Thinkphp
9.8
30%
Dec 23ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true)
CVE-2022-44289
TH
Thinkphp
Thinkphp
8.8
3%
Dec 6Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell
CVE-2022-38352
TH
Thinkphp
Thinkphp
9.8
21%
Sep 15ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache
CVE-2022-33107
TH
Thinkphp
Thinkphp
9.8
24%
Jun 29ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php
CVE-2021-23592
TH
Thinkphp
Thinkphp
9.8
2%
May 6The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class
CVE-2022-25481
TH
Thinkphp
Thinkphp
7.5
5%
Mar 21ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter
CVE-2021-44892
TH
Thinkphp
Thinkphp
8.8
2%
Feb 10A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges
CVE-2021-44350
TH
Thinkphp
Thinkphp
9.8
1%
Dec 15SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php
CVE-2021-36567
TH
Thinkphp
Thinkphp
9.8
2%
Dec 6ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache
CVE-2021-36564
TH
Thinkphp
Thinkphp
9.8
2%
Dec 6ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php
CVE-2020-20120
TH
Thinkphp
Thinkphp
9.8
2%
Sep 28ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods
CVE-2019-9082
In wildKEV
TH
Thinkphp
Thinkphp
8.8
97%
Feb 24ThinkPHP Remote Code Execution Vulnerability
CVE-2018-20062
In wildKEV
NO
noneCms
ThinkPHP
9.8
100%
Dec 11ThinkPHP "noneCms" Remote Code Execution Vulnerability
CVE-2018-18546
TH
Thinkphp
Thinkphp
9.8
2%
Oct 21ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable
CVE-2018-18530
TH
Thinkphp
Thinkphp
9.8
1%
Oct 19ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable
CVE-2018-18529
TH
Thinkphp
Thinkphp
9.8
1%
Oct 19ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable
CVE-2018-17566
TH
Thinkphp
Thinkphp
9.8
2%
Sep 26In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request
CVE-2018-16385
TH
Thinkphp
Thinkphp
9.8
2%
Sep 3ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string
CVE-2018-10225
TH
Thinkphp
Thinkphp
9.8
1%
Apr 19thinkphp 3.1.3 has SQL Injection via the index.php s parameter