PHP vulnerabilities
The newest vulnerabilities affecting PHP, up to 200. Subscribe by RSS.
- CVE-2026-109619RCE via stale global statePHP Group PHP
- CVE-2026-109618RCE via OOM corruptionPHP Group PHP
- CVE-2026-85733FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variablesfrankenphp
- CVE-2026-82416FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared modulefrankenphp · github.com/dunglas/frankenphp
- CVE-2026-92842OOB read / info leak in convert.* stream filters when line-break-chars contains NULPHP Group PHP
- CVE-2026-91768IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)PHP Group PHP
- CVE-2026-91769TLS Hostname Verification Falls Back to CN After SAN MismatchPHP Group PHP
- CVE-2026-91767Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CNPHP Group PHP
- CVE-2025-1218Various packet overreads in mysqlnd_writeprotocol.cPHP Group PHP
- CVE-2026-91766Cross-origin credential leak in HTTP stream wrapper redirectsPHP Group PHP
- CVE-2026-91765SOAP: Unbounded Recursion in Server-Side cleanup_xml_nodePHP Group PHP
- CVE-2025-14181Integer overflow to buffer overflow in soap HTTP parsingPHP Group PHP
- CVE-2026-17545PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoSPHP Group PHP
- CVE-2026-6103Phar TAR phar_tar_number() Integer Overflow - Archive Entry InjectionPHP Group PHP · libphp +2
- CVE-2026-93682Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location headerPHP Group PHP
- CVE-2026-46594Reflected XSS in PHP Poll ScriptPHP Jabbers PHP Poll Script
- CVE-2026-46593Authenticated SQL Injection in PHP Poll ScriptPHP Jabbers PHP Poll Script
- CVE-2025-67651CSRF in PHP Jabbers scriptsPHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33
- CVE-2025-67650Authenticated SQL Injection in PHP Jabbers scriptsPHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33
- CVE-2025-67649Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script scriptPHP Jabbers Car Rental Script
- CVE-2026-7260Stack overflow in phar with circular symlinksPHP Group PHP
- CVE-2026-17544Out-of-bounds write in bccomp() via crafted operand and scalePHP Group PHP
- CVE-2026-17543SQL injection in ext-pgsql via E'...' backslash breakoutPHP Group PHP
- CVE-2026-14355ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PADphp
- CVE-2026-48979PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smugglingphp-standard-library · php-standard-library/h2 +1
- CVE-2026-45062FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Filesfrankenphp · github.com/dunglas/frankenphp
- CVE-2026-10273php-censor Webhook Endpoint GitBuild.php os command injectionphp-censor
- CVE-2026-7263DoS attack via DOMNode::C14N()PHP Group PHP
- CVE-2026-6104Global buffer over-read in mb_convert_encoding() with attacker-supplied encodingPHP Group PHP
- CVE-2026-7258Out-of-bounds read in urldecode() on NetBSDPHP Group PHP
- CVE-2026-6722Use-After-Free in SOAP using Apache mapPHP Group PHP
- CVE-2026-7259Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()PHP Group PHP
- CVE-2026-7261SoapServer session-persisted object use-after-free via SOAP header faultPHP Group PHP
- CVE-2026-7262NULL pointer dereference in SOAP apache:Map decoder with missing <value>PHP Group PHP
- CVE-2025-14179SQL injection in pdo_firebird via NUL bytes in quoted stringsPHP Group PHP
- CVE-2026-7568Signed integer overflow in metaphone()PHP Group PHP
- CVE-2026-6735XSS within PHP-FPM status endpointPHP Group PHP
- CVE-2025-41011HTML injection in PHP Point Of SalePHP Point Of Sale
- CVE-2026-24895FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary filesfrankenphp · github.com/dunglas/frankenphp
- CVE-2026-24894FrankenPHP leaks session data between requests in worker modefrankenphp · github.com/dunglas/frankenphp
- CVE-2020-37152PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS)PHP-Fusion
- CVE-2020-37137PHP-Fusion 9.03.50 - 'panels.php' Eval InjectionPHP Fusion
- CVE-2020-36996PHPFusion 9.03.50 - Persistent Cross-Site ScriptingPhp-Fusion PHPFusion
- CVE-2025-14177Information Leak of Memory in getimagesizePHP Group PHP
- CVE-2025-14178Heap buffer overflow in array_merge()PHP Group PHP
- CVE-2025-14180NULL Pointer Dereference in PDO quotingPHP Group PHP
- CVE-2023-53928PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager UploadPhp-fusion PHPFusion
- CVE-2012-10056PHP Volunteer Management System 1.0.2 Arbitrary File UploadPHP Volunteer Management
- CVE-2013-10070PHP-Charts v1.0 PHP Code ExecutionPHP-Charts
- CVE-2025-1735pgsql extension does not check for errors during escapingPHP Group PHP
- CVE-2025-1220Null byte termination in hostnamesPHP Group PHP
- CVE-2025-6491NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace PrefixPHP Group PHP
- CVE-2024-11235Reference counting in php_request_shutdown causes Use-After-FreePHP Group PHP
- CVE-2025-1861Stream HTTP wrapper truncates redirect location to 1024 bytesPHP Group PHP
- CVE-2025-1736Stream HTTP wrapper header check might omit basic auth headerPHP Group PHP
- CVE-2025-1734Streams HTTP wrapper does not fail for headers with invalid name and no colonPHP Group PHP
- CVE-2025-1219libxml streams use wrong content-type header when requesting a redirected resourcePHP Group PHP
- CVE-2025-1217Header parser of http stream wrapper does not handle folded headersPHP Group PHP
- CVE-2022-31631PDO::quote() may return unquoted stringPHP Group PHP
- CVE-2024-11233Single byte overread with convert.quoted-printable-decode filterPHP Group PHP
- CVE-2024-11234Configuring a proxy in a stream context might allow for CRLF injection in URIsPHP Group PHP
- CVE-2024-11236Integer overflow in the firebird and dblib quoters causing OOB writesPHP Group PHP
- CVE-2024-8929Leak partial content of the heap through heap buffer over-read in mysqlndPHP Group PHP
- CVE-2024-8932OOB access in ldap_escapePHP Group PHP
- CVE-2024-9026PHP-FPM logs from children may be alteredPHP Group PHP
- CVE-2024-8927cgi.force_redirect configuration is bypassable due to the environment variable collisionPHP Group PHP
- CVE-2024-8926PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)PHP Group PHP
- CVE-2024-8925Erroneous parsing of multipart form dataPHP Group PHP
- CVE-2024-2408PHP is vulnerable to the Marvin AttackPHP Group PHP
- CVE-2024-4577Argument Injection in PHP-CGIPHP Group PHP
- CVE-2024-5585Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)PHP Group PHP
- CVE-2024-5458Filter bypass in filter_var (FILTER_VALIDATE_URL)PHP Group PHP
- CVE-2024-5312Cross-Site Scripting vulnerability in PHP Server MonitorPHP Server Monitor · phpservermon/phpservermon
- CVE-2024-1874Command injection via array-ish $command parameter of proc_open()PHP Group PHP
- CVE-2024-2757PHP mb_encode_mimeheader runs endlessly for some inputsPHP Group PHP
- CVE-2024-3096PHP function password_verify can erroneously return true when argument contains NULPHP Group PHP
- CVE-2024-2756__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fixPHP Group PHP
- CVE-2022-4900Potential buffer overflow in php_cli_server_startup_workersphp · Red Hat Enterprise Linux +2
- CVE-2023-3824Buffer overflow and overread in phar_dir_read()PHP Group PHP
- CVE-2023-3823Security issue with external entity loading in XML without enabling itPHP Group PHP
- CVE-2023-4117PHP Jabbers Rental Property Booking index.php cross site scriptingPHP Jabbers Rental Property Booking
- CVE-2023-4116PHP Jabbers Taxi Booking index.php cross site scriptingPHP Jabbers Taxi Booking
- CVE-2023-4115PHP Jabbers Cleaning Business index.php cross site scriptingPHP Jabbers Cleaning Business
- CVE-2023-4114PHP Jabbers Night Club Booking Software index.php cross site scriptingPHP Jabbers Night Club Booking Software
- CVE-2023-4113PHP Jabbers Service Booking Script index.php cross site scriptingPHP Jabbers Service Booking Script
- CVE-2023-4112PHP Jabbers Shuttle Booking Software index.php cross site scriptingPHP Jabbers Shuttle Booking Software
- CVE-2023-4111PHP Jabbers Bus Reservation System index.php cross site scriptingPHP Jabbers Bus Reservation System
- CVE-2023-4110PHP Jabbers Availability Booking Calendar index.php cross site scriptingPHP Jabbers Availability Booking Calendar
- CVE-2023-3247Missing error check and insufficient random bytes in HTTP Digest authentication for SOAPPHP Group PHP
- CVE-2016-15031PHP-Login POST Parameter class.loginscript.php checkLogin sql injectionPHP-Login
- CVE-2023-0568Array overrun in common path resolve codePHP Group PHP
- CVE-2023-0662DoS vulnerability when parsing multipart request bodyPHP Group PHP
- CVE-2023-0567password_verify() always returns true for some invalid hashesPHP Group PHP
- CVE-2022-31630OOB read due to insufficient input validation in imageloadfont()PHP Group PHP
- CVE-2022-40294CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLCPHP Point of Sale
- CVE-2022-40290Reflected cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-40295Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-40287Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields.PHP Point of Sale
- CVE-2022-40296Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-40289Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via file upload and download functionality.PHP Point of Sale
- CVE-2022-40292Unauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-40291Cross-site request forgery (CSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLCPHP Point of Sale
- CVE-2022-40293Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC.PHP Point of Sale
- CVE-2022-40288Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionalityPHP Point of Sale
- CVE-2022-31629$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesPHP Group PHP
- CVE-2022-31628phar wrapper can occur dos when using quine gzip filePHP Group PHP
- CVE-2022-37344WordPress Accommodation System plugin <= 1.0.1 - Missing Access Control vulnerabilityPHP Crafts Accommodation System
- CVE-2022-31627Heap buffer overflow in finfo_bufferPHP Group PHP
- CVE-2022-31626mysqlnd/pdo password buffer overflowPHP Group PHP
- CVE-2022-31625Freeing unallocated memory in php_pgsql_free_params()PHP Group PHP
- CVE-2021-21708UAF due to php_filter_float() failingPHP Group PHP
- CVE-2021-21707Special characters break path parsing in XML functionsPHP Group PHP
- CVE-2021-21703PHP-FPM memory access in root process leading to privilege escalationPHP Group PHP
- CVE-2021-21706ZipArchive::extractTo may extract outside of destination dirPHP Group PHP
- CVE-2021-21705Incorrect URL validation in FILTER_VALIDATE_URLPHP Group PHP
- CVE-2021-21704Multiple vulnerabilities in Firebird client extensionPHP Group PHP
- CVE-2021-20725Reflected cross-site scripting vulnerability in the admin page of [Calendar01] free edition ver1.0.1 and earlier allows a remote attacker toPHP Factory [Calendar01] free edition
- CVE-2021-20723Reflected cross-site scripting vulnerability in [MailForm01] free edition (versions which the last updated date listed at the top of descripPHP Factory [MailForm01] free edition
- CVE-2021-20724Reflected cross-site scripting vulnerability in the admin page of [Telop01] free edition ver1.0.1 and earlier allows a remote attacker to inPHP Factory [Telop01] free edition
- CVE-2021-21702Null Dereference in SoapClientPHP Group PHP
- CVE-2020-7071FILTER_VALIDATE_URL accepts URLs with invalid userinfoPHP Group PHP
- CVE-2020-7070PHP parses encoded cookie names so malicious `__Host-` cookies can be sentPHP Group PHP
- CVE-2020-7069Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IVPHP Group PHP
- CVE-2020-7068Use of freed hash key in the phar_parse_zipfile functionPHP Group PHP
- CVE-2020-5616[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free editionPHP Factory [Calendar01], [Calendar02], [PKOBO-News01], [PK…
- CVE-2020-5615Cross-site request forgery (CSRF) vulnerability in [Calendar01] free edition ver1.0.0 and [Calendar02] free edition ver1.0.0 allows remote aPHP Factory [Calendar01] and [Calendar02]
- CVE-2019-11048Temporary files are not cleaned after OOM when parsing HTTP request dataPHP Group PHP
- CVE-2020-7067OOB Read in urldecode()PHP Group PHP
- CVE-2020-7066get_headers() silently truncates after a null bytePHP Group PHP
- CVE-2020-7065mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_fullPHP Group PHP
- CVE-2020-7064Use-of-uninitialized-value in exifPHP Group PHP
- CVE-2020-7063Files added to tar with Phar::buildFromIterator have all-access permissionsPHP Group PHP
- CVE-2020-7062Null Pointer Dereference in PHP Session Upload ProgressPHP Group PHP
- CVE-2020-7061heap-buffer-overflow in phar_extract_filePHP Group PHP
- CVE-2014-3622Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackerPHP
- CVE-2020-7060global buffer-overflow in mbfl_filt_conv_big5_wcharPHP Group PHP
- CVE-2020-7059OOB read in php_strip_tags_exPHP Group PHP
- CVE-2019-10774php-shellcommand versions before 1.6.1 have a command injection vulnerability.php-shellcommand · mikehaertl/php-shellcommand
- CVE-2019-11050Use-after-free in exif parsing under memory sanitizerPHP Group PHP
- CVE-2019-11049mail() may release string with refcount==1 twicePHP Group PHP
- CVE-2019-11047Heap-buffer-overflow READ in exifPHP Group PHP
- CVE-2019-11046Buffer underflow in bc_shift_addsubPHP Group PHP
- CVE-2019-11045DirectoryIterator class silently truncates after a null bytePHP Group PHP
- CVE-2019-11044link() silently truncates after a null byte on WindowsPHP Group PHP
- CVE-2015-8980The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code.php-gettext
- CVE-2019-11043Underflow in PHP-FPM can lead to RCEPHP
- CVE-2019-11042heap-buffer-overflow on exif_process_user_comment in EXIF extensionPHP Group PHP
- CVE-2019-11041heap-buffer-overflow on exif_scan_thumbnail in EXIF extensionPHP Group PHP
- CVE-2019-1010028phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS).PHP Scripts Mall Pvt. School College Portal with ERP Script
- CVE-2019-11040Heap buffer overflow in EXIF extensionPHP Group PHP
- CVE-2019-11039Out-of-bounds read in iconv.cPHP Group PHP
- CVE-2019-11038Uninitialized read in gdImageCreateFromXbmPHP Group PHP
- CVE-2019-11037Out of bounds memory write in PHP Imagick extensionPHP Group PHP Imagick extension
- CVE-2019-11036Heap over-read in PHP EXIF extensionPHP Group PHP
- CVE-2019-11035Heap over-read in PHP EXIF extensionPHP Group PHP
- CVE-2019-11034Heap over-read in PHP EXIF extensionPHP Group PHP
- CVE-2016-9482PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypassPHP FormMail Generator
- CVE-2016-9483PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted dataPHP FormMail Generator
- CVE-2016-9484PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder directories and is vulnerable to path traversalPHP FormMail Generator
- CVE-2016-9492PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file typesPHP FormMail Generator
- CVE-2016-9493PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scriptingPHP FormMail Generator
- CVE-2016-7479In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-afPHP 7.x
- CVE-2016-7480The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, whicPHP before
- CVE-2016-7478Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinPHP before