- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 19 · 3 critical, 2 high, 2 medium
- Registry
- Packagist
Advisories 19
- CVE-2025-50706Critical 9.8
An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function
Affected: through 5.1.41.
- CVE-2024-44902Critical 9.8
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Affected: from 6.1.3, through 8.0.4.
- CVE-2024-34467Medium 6.1
ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.
Affected: from 8.0.0, fixed in 8.0.4; from 6.1.0, fixed in 6.1.5; fixed in 6.0.17.
- CVE-2022-47945Critical 9.8
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled…
Affected: fixed in 6.0.14.
- CVE-2022-44289High 8.8
Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
Affected: through 5.0.24; from 5.1, through 5.1.41.
- CVE-2022-38352Unrated
ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache.
Affected: through 6.0.13.
- CVE-2022-33107Unrated
ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component…
Affected: through 6.0.12.
- CVE-2021-23592High 7.7
Deserialization of Untrusted Data
Affected: fixed in 6.0.12.
- CVE-2022-25481Medium 4.0
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter.
Affected: through 5.0.24.
- CVE-2021-44892Unrated
A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user…
Affected: through 3.2.3.
- CVE-2021-44350Unrated
SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
Affected: from 5.0, through 5.1.22.
- CVE-2021-36567Unrated
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.
Affected: through 6.0.8.
- CVE-2021-36564Unrated
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component…
Affected: fixed in 6.0.9.
- CVE-2018-18546Unrated
ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the…
Affected: through 3.2.4.
- CVE-2018-18530Unrated
ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the…
Affected: through 5.1.25.
Show all 19 advisoriesShow fewer advisories
- CVE-2018-18529Unrated
ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles…
Affected: through 3.2.4.
- CVE-2018-17566Unrated
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's…
Affected: versions 5.1.24.
- CVE-2018-16385Unrated
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.
Affected: fixed in 5.1.23.
- CVE-2018-10225Unrated
thinkphp 3.1.3 has SQL Injection via the index.php s parameter.
Affected: versions 3.1.3.