# cve.now: PHP

The newest entries affecting PHP (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-109619](https://cve.now/CVE-2026-109619.md): RCE via stale global state (CVSS 9.2, KEV, PHP Group PHP)
- [CVE-2026-109618](https://cve.now/CVE-2026-109618.md): RCE via OOM corruption (CVSS 9.2, KEV, PHP Group PHP)
- [CVE-2026-85733](https://cve.now/CVE-2026-85733.md): FrankenPHP: Docker images serve phpinfo() as the default index.php, leaking environment variables (CVSS 5.3, frankenphp)
- [CVE-2026-82416](https://cve.now/CVE-2026-82416.md): FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module (CVSS 7.7, frankenphp · github.com/dunglas/frankenphp)
- [CVE-2026-92842](https://cve.now/CVE-2026-92842.md): OOB read / info leak in convert.\* stream filters when line-break-chars contains NUL (CVSS 5.9, PHP Group PHP)
- [CVE-2026-91768](https://cve.now/CVE-2026-91768.md): IPv6 ACL bypass in FastCGI listen.allowed\_clients due to partial address comparison (memcmp 12 bytes) (CVSS 6.5, PHP Group PHP)
- [CVE-2026-91769](https://cve.now/CVE-2026-91769.md): TLS Hostname Verification Falls Back to CN After SAN Mismatch (CVSS 4.3, PHP Group PHP)
- [CVE-2026-91767](https://cve.now/CVE-2026-91767.md): Heap-buffer-overflow in php\_openssl\_matches\_wildcard\_name on crafted server cert wildcard CN (CVSS 6.5, PHP Group PHP)
- [CVE-2025-1218](https://cve.now/CVE-2025-1218.md): Various packet overreads in mysqlnd\_writeprotocol.c (CVSS 3.4, PHP Group PHP)
- [CVE-2026-91766](https://cve.now/CVE-2026-91766.md): Cross-origin credential leak in HTTP stream wrapper redirects (CVSS 5.9, PHP Group PHP)
- [CVE-2026-91765](https://cve.now/CVE-2026-91765.md): SOAP: Unbounded Recursion in Server-Side cleanup\_xml\_node (CVSS 7.5, PHP Group PHP)
- [CVE-2025-14181](https://cve.now/CVE-2025-14181.md): Integer overflow to buffer overflow in soap HTTP parsing (CVSS 6.5, PHP Group PHP)
- [CVE-2026-17545](https://cve.now/CVE-2026-17545.md): PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS (CVSS 6.9, PHP Group PHP)
- [CVE-2026-6103](https://cve.now/CVE-2026-6103.md): Phar TAR phar\_tar\_number() Integer Overflow - Archive Entry Injection (CVSS 4.3, PHP Group PHP · libphp +2)
- [CVE-2026-93682](https://cve.now/CVE-2026-93682.md): Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header (CVSS 5.8, PHP Group PHP)
- [CVE-2026-46594](https://cve.now/CVE-2026-46594.md): Reflected XSS in PHP Poll Script (CVSS 5.1, PHP Jabbers PHP Poll Script)
- [CVE-2026-46593](https://cve.now/CVE-2026-46593.md): Authenticated SQL Injection in PHP Poll Script (CVSS 8.6, PHP Jabbers PHP Poll Script)
- [CVE-2025-67651](https://cve.now/CVE-2025-67651.md): CSRF in PHP Jabbers scripts (CVSS 6.9, PHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33)
- [CVE-2025-67650](https://cve.now/CVE-2025-67650.md): Authenticated SQL Injection in PHP Jabbers scripts (CVSS 8.6, PHP Jabbers Appointment Scheduler · PHP Jabbers Bus Res… +33)
- [CVE-2025-67649](https://cve.now/CVE-2025-67649.md): Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script (CVSS 9.3, PHP Jabbers Car Rental Script)
- [CVE-2026-7260](https://cve.now/CVE-2026-7260.md): Stack overflow in phar with circular symlinks (CVSS 5.4, PHP Group PHP)
- [CVE-2026-17544](https://cve.now/CVE-2026-17544.md): Out-of-bounds write in bccomp() via crafted operand and scale (CVSS 8.1, PHP Group PHP)
- [CVE-2026-17543](https://cve.now/CVE-2026-17543.md): SQL injection in ext-pgsql via E'...' backslash breakout (CVSS 8.1, PHP Group PHP)
- [CVE-2026-14355](https://cve.now/CVE-2026-14355.md): ext/openssl: Memory corruption in openssl\_encrypt with AES-WRAP-PAD (CVSS 5.6, php)
- [CVE-2026-48979](https://cve.now/CVE-2026-48979.md): PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling (CVSS 7.5, php-standard-library · php-standard-library/h2 +1)
- [CVE-2026-45062](https://cve.now/CVE-2026-45062.md): FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP Files (CVSS 8.1, frankenphp · github.com/dunglas/frankenphp)
- [CVE-2026-10273](https://cve.now/CVE-2026-10273.md): php-censor Webhook Endpoint GitBuild.php os command injection (CVSS 6.9, php-censor)
- [CVE-2026-7263](https://cve.now/CVE-2026-7263.md): DoS attack via DOMNode::C14N() (CVSS 6.3, PHP Group PHP)
- [CVE-2026-6104](https://cve.now/CVE-2026-6104.md): Global buffer over-read in mb\_convert\_encoding() with attacker-supplied encoding (CVSS 6.3, PHP Group PHP)
- [CVE-2026-7258](https://cve.now/CVE-2026-7258.md): Out-of-bounds read in urldecode() on NetBSD (CVSS 6.3, PHP Group PHP)
- [CVE-2026-6722](https://cve.now/CVE-2026-6722.md): Use-After-Free in SOAP using Apache map (CVSS 9.5, PHP Group PHP)
- [CVE-2026-7259](https://cve.now/CVE-2026-7259.md): Null pointer dereference in php\_mb\_check\_encoding() via mb\_ereg\_search\_init() (CVSS 2.1, PHP Group PHP)
- [CVE-2026-7261](https://cve.now/CVE-2026-7261.md): SoapServer session-persisted object use-after-free via SOAP header fault (CVSS 6.3, PHP Group PHP)
- [CVE-2026-7262](https://cve.now/CVE-2026-7262.md): NULL pointer dereference in SOAP apache:Map decoder with missing \<value\> (CVSS 2.9, PHP Group PHP)
- [CVE-2025-14179](https://cve.now/CVE-2025-14179.md): SQL injection in pdo\_firebird via NUL bytes in quoted strings (CVSS 7.4, PHP Group PHP)
- [CVE-2026-7568](https://cve.now/CVE-2026-7568.md): Signed integer overflow in metaphone() (CVSS 6.3, PHP Group PHP)
- [CVE-2026-6735](https://cve.now/CVE-2026-6735.md): XSS within PHP-FPM status endpoint (CVSS 7.3, PHP Group PHP)
- [CVE-2025-41011](https://cve.now/CVE-2025-41011.md): HTML injection in PHP Point Of Sale (CVSS 5.1, PHP Point Of Sale)
- [CVE-2026-24895](https://cve.now/CVE-2026-24895.md): FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files (CVSS 8.9, frankenphp · github.com/dunglas/frankenphp)
- [CVE-2026-24894](https://cve.now/CVE-2026-24894.md): FrankenPHP leaks session data between requests in worker mode (CVSS 8.7, frankenphp · github.com/dunglas/frankenphp)
- [CVE-2020-37152](https://cve.now/CVE-2020-37152.md): PHP-Fusion 9.03.50 panels.php - Cross-Site Scripting (XSS) (CVSS 5.1, PHP-Fusion)
- [CVE-2020-37137](https://cve.now/CVE-2020-37137.md): PHP-Fusion 9.03.50 - 'panels.php' Eval Injection (CVSS 8.6, PHP Fusion)
- [CVE-2020-36996](https://cve.now/CVE-2020-36996.md): PHPFusion 9.03.50 - Persistent Cross-Site Scripting (CVSS 5.1, Php-Fusion PHPFusion)
- [CVE-2025-14177](https://cve.now/CVE-2025-14177.md): Information Leak of Memory in getimagesize (CVSS 6.3, PHP Group PHP)
- [CVE-2025-14178](https://cve.now/CVE-2025-14178.md): Heap buffer overflow in array\_merge() (CVSS 6.5, PHP Group PHP)
- [CVE-2025-14180](https://cve.now/CVE-2025-14180.md): NULL Pointer Dereference in PDO quoting (CVSS 8.2, PHP Group PHP)
- [CVE-2023-53928](https://cve.now/CVE-2023-53928.md): PHPFusion 9.10.30 Stored Cross-Site Scripting via File Manager Upload (CVSS 5.1, Php-fusion PHPFusion)
- [CVE-2012-10056](https://cve.now/CVE-2012-10056.md): PHP Volunteer Management System 1.0.2 Arbitrary File Upload (CVSS 8.7, PHP Volunteer Management)
- [CVE-2013-10070](https://cve.now/CVE-2013-10070.md): PHP-Charts v1.0 PHP Code Execution (CVSS 10.0, PHP-Charts)
- [CVE-2025-1735](https://cve.now/CVE-2025-1735.md): pgsql extension does not check for errors during escaping (CVSS 5.9, PHP Group PHP)
- [CVE-2025-1220](https://cve.now/CVE-2025-1220.md): Null byte termination in hostnames (CVSS 3.7, PHP Group PHP)
- [CVE-2025-6491](https://cve.now/CVE-2025-6491.md): NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVSS 5.9, PHP Group PHP)
- [CVE-2024-11235](https://cve.now/CVE-2024-11235.md): Reference counting in php\_request\_shutdown causes Use-After-Free (CVSS 9.2, PHP Group PHP)
- [CVE-2025-1861](https://cve.now/CVE-2025-1861.md): Stream HTTP wrapper truncates redirect location to 1024 bytes (CVSS 6.3, PHP Group PHP)
- [CVE-2025-1736](https://cve.now/CVE-2025-1736.md): Stream HTTP wrapper header check might omit basic auth header (CVSS 6.3, PHP Group PHP)
- [CVE-2025-1734](https://cve.now/CVE-2025-1734.md): Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVSS 6.3, PHP Group PHP)
- [CVE-2025-1219](https://cve.now/CVE-2025-1219.md): libxml streams use wrong content-type header when requesting a redirected resource (CVSS 6.3, PHP Group PHP)
- [CVE-2025-1217](https://cve.now/CVE-2025-1217.md): Header parser of http stream wrapper does not handle folded headers (CVSS 6.3, PHP Group PHP)
- [CVE-2022-31631](https://cve.now/CVE-2022-31631.md): PDO::quote() may return unquoted string (CVSS 9.1, PHP Group PHP)
- [CVE-2024-11233](https://cve.now/CVE-2024-11233.md): Single byte overread with convert.quoted-printable-decode filter (CVSS 4.8, PHP Group PHP)
- [CVE-2024-11234](https://cve.now/CVE-2024-11234.md): Configuring a proxy in a stream context might allow for CRLF injection in URIs (CVSS 4.8, PHP Group PHP)
- [CVE-2024-11236](https://cve.now/CVE-2024-11236.md): Integer overflow in the firebird and dblib quoters causing OOB writes (CVSS 9.8, PHP Group PHP)
- [CVE-2024-8929](https://cve.now/CVE-2024-8929.md): Leak partial content of the heap through heap buffer over-read in mysqlnd (CVSS 5.8, PHP Group PHP)
- [CVE-2024-8932](https://cve.now/CVE-2024-8932.md): OOB access in ldap\_escape (CVSS 9.8, PHP Group PHP)
- [CVE-2024-9026](https://cve.now/CVE-2024-9026.md): PHP-FPM logs from children may be altered (CVSS 3.3, PHP Group PHP)
- [CVE-2024-8927](https://cve.now/CVE-2024-8927.md): cgi.force\_redirect configuration is bypassable due to the environment variable collision (CVSS 7.5, PHP Group PHP)
- [CVE-2024-8926](https://cve.now/CVE-2024-8926.md): PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) (CVSS 8.1, PHP Group PHP)
- [CVE-2024-8925](https://cve.now/CVE-2024-8925.md): Erroneous parsing of multipart form data (CVSS 3.1, PHP Group PHP)
- [CVE-2024-2408](https://cve.now/CVE-2024-2408.md): PHP is vulnerable to the Marvin Attack (CVSS 5.9, PHP Group PHP)
- [CVE-2024-4577](https://cve.now/CVE-2024-4577.md): Argument Injection in PHP-CGI (CVSS 9.8, KEV, PHP Group PHP)
- [CVE-2024-5585](https://cve.now/CVE-2024-5585.md): Command injection via array-ish $command parameter of proc\_open() (bypass CVE-2024-1874 fix) (CVSS 7.7, PHP Group PHP)
- [CVE-2024-5458](https://cve.now/CVE-2024-5458.md): Filter bypass in filter\_var (FILTER\_VALIDATE\_URL) (CVSS 5.3, PHP Group PHP)
- [CVE-2024-5312](https://cve.now/CVE-2024-5312.md): Cross-Site Scripting vulnerability in PHP Server Monitor (CVSS 6.3, PHP Server Monitor · phpservermon/phpservermon)
- [CVE-2024-1874](https://cve.now/CVE-2024-1874.md): Command injection via array-ish $command parameter of proc\_open() (CVSS 9.4, PHP Group PHP)
- [CVE-2024-2757](https://cve.now/CVE-2024-2757.md): PHP mb\_encode\_mimeheader runs endlessly for some inputs (CVSS 7.5, PHP Group PHP)
- [CVE-2024-3096](https://cve.now/CVE-2024-3096.md): PHP function password\_verify can erroneously return true when argument contains NUL (CVSS 6.5, PHP Group PHP)
- [CVE-2024-2756](https://cve.now/CVE-2024-2756.md): \_\_Host-/\_\_Secure- cookie bypass due to partial CVE-2022-31629 fix (CVSS 6.5, PHP Group PHP)
- [CVE-2022-4900](https://cve.now/CVE-2022-4900.md): Potential buffer overflow in php\_cli\_server\_startup\_workers (CVSS 6.2, php · Red Hat Enterprise Linux +2)
- [CVE-2023-3824](https://cve.now/CVE-2023-3824.md): Buffer overflow and overread in phar\_dir\_read() (CVSS 9.4, PHP Group PHP)
- [CVE-2023-3823](https://cve.now/CVE-2023-3823.md): Security issue with external entity loading in XML without enabling it (CVSS 8.6, PHP Group PHP)
- [CVE-2023-4117](https://cve.now/CVE-2023-4117.md): PHP Jabbers Rental Property Booking index.php cross site scripting (CVSS 4.3, PHP Jabbers Rental Property Booking)
- [CVE-2023-4116](https://cve.now/CVE-2023-4116.md): PHP Jabbers Taxi Booking index.php cross site scripting (CVSS 4.3, PHP Jabbers Taxi Booking)
- [CVE-2023-4115](https://cve.now/CVE-2023-4115.md): PHP Jabbers Cleaning Business index.php cross site scripting (CVSS 4.3, PHP Jabbers Cleaning Business)
- [CVE-2023-4114](https://cve.now/CVE-2023-4114.md): PHP Jabbers Night Club Booking Software index.php cross site scripting (CVSS 4.3, PHP Jabbers Night Club Booking Software)
- [CVE-2023-4113](https://cve.now/CVE-2023-4113.md): PHP Jabbers Service Booking Script index.php cross site scripting (CVSS 4.3, PHP Jabbers Service Booking Script)
- [CVE-2023-4112](https://cve.now/CVE-2023-4112.md): PHP Jabbers Shuttle Booking Software index.php cross site scripting (CVSS 4.3, PHP Jabbers Shuttle Booking Software)
- [CVE-2023-4111](https://cve.now/CVE-2023-4111.md): PHP Jabbers Bus Reservation System index.php cross site scripting (CVSS 4.3, PHP Jabbers Bus Reservation System)
- [CVE-2023-4110](https://cve.now/CVE-2023-4110.md): PHP Jabbers Availability Booking Calendar index.php cross site scripting (CVSS 3.5, PHP Jabbers Availability Booking Calendar)
- [CVE-2023-3247](https://cve.now/CVE-2023-3247.md): Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP (CVSS 2.6, PHP Group PHP)
- [CVE-2016-15031](https://cve.now/CVE-2016-15031.md): PHP-Login POST Parameter class.loginscript.php checkLogin sql injection (CVSS 7.3, PHP-Login)
- [CVE-2023-0568](https://cve.now/CVE-2023-0568.md): Array overrun in common path resolve code (CVSS 7.5, PHP Group PHP)
- [CVE-2023-0662](https://cve.now/CVE-2023-0662.md): DoS vulnerability when parsing multipart request body (CVSS 7.5, PHP Group PHP)
- [CVE-2023-0567](https://cve.now/CVE-2023-0567.md): password\_verify() always returns true for some invalid hashes (CVSS 7.7, PHP Group PHP)
- [CVE-2022-31630](https://cve.now/CVE-2022-31630.md): OOB read due to insufficient input validation in imageloadfont() (CVSS 6.5, PHP Group PHP)
- [CVE-2022-40294](https://cve.now/CVE-2022-40294.md): CSV Injection in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC (CVSS 8.8, PHP Point of Sale)
- [CVE-2022-40290](https://cve.now/CVE-2022-40290.md): Reflected cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (CVSS 6.1, PHP Point of Sale)
- [CVE-2022-40295](https://cve.now/CVE-2022-40295.md): Authenticated sensitive information disclosure in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (no CVSS, PHP Point of Sale)
- [CVE-2022-40287](https://cve.now/CVE-2022-40287.md): Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via user profile data fields. (CVSS 9.0, PHP Point of Sale)
- [CVE-2022-40296](https://cve.now/CVE-2022-40296.md): Server-side request forgery (SSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (CVSS 9.8, PHP Point of Sale)
- [CVE-2022-40289](https://cve.now/CVE-2022-40289.md): Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via file upload and download functionality. (CVSS 9.0, PHP Point of Sale)
- [CVE-2022-40292](https://cve.now/CVE-2022-40292.md): Unauthenticated username enumeration in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (CVSS 5.3, PHP Point of Sale)
- [CVE-2022-40291](https://cve.now/CVE-2022-40291.md): Cross-site request forgery (CSRF) in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC (CVSS 8.8, PHP Point of Sale)
- [CVE-2022-40293](https://cve.now/CVE-2022-40293.md): Session fixation in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC. (CVSS 9.8, PHP Point of Sale)
- [CVE-2022-40288](https://cve.now/CVE-2022-40288.md): Stored cross-site scripting in PHP Point of Sale version 19.0, by PHP Point of Sale, LLC via messaging functionality (CVSS 9.0, PHP Point of Sale)
- [CVE-2022-31629](https://cve.now/CVE-2022-31629.md): $\_COOKIE names string replacement (. -\> \_): cookie integrity vulnerabilities (CVSS 6.5, PHP Group PHP)
- [CVE-2022-31628](https://cve.now/CVE-2022-31628.md): phar wrapper can occur dos when using quine gzip file (CVSS 2.3, PHP Group PHP)
- [CVE-2022-37344](https://cve.now/CVE-2022-37344.md): WordPress Accommodation System plugin \<= 1.0.1 - Missing Access Control vulnerability (CVSS 7.6, PHP Crafts Accommodation System)
- [CVE-2022-31627](https://cve.now/CVE-2022-31627.md): Heap buffer overflow in finfo\_buffer (CVSS 7.7, PHP Group PHP)
- [CVE-2022-31626](https://cve.now/CVE-2022-31626.md): mysqlnd/pdo password buffer overflow (CVSS 7.5, PHP Group PHP)
- [CVE-2022-31625](https://cve.now/CVE-2022-31625.md): Freeing unallocated memory in php\_pgsql\_free\_params() (CVSS 8.1, PHP Group PHP)
- [CVE-2021-21708](https://cve.now/CVE-2021-21708.md): UAF due to php\_filter\_float() failing (CVSS 8.2, PHP Group PHP)
- [CVE-2021-21707](https://cve.now/CVE-2021-21707.md): Special characters break path parsing in XML functions (CVSS 5.3, PHP Group PHP)
- [CVE-2021-21703](https://cve.now/CVE-2021-21703.md): PHP-FPM memory access in root process leading to privilege escalation (CVSS 7.8, PHP Group PHP)
- [CVE-2021-21706](https://cve.now/CVE-2021-21706.md): ZipArchive::extractTo may extract outside of destination dir (CVSS 5.3, PHP Group PHP)
- [CVE-2021-21705](https://cve.now/CVE-2021-21705.md): Incorrect URL validation in FILTER\_VALIDATE\_URL (CVSS 4.3, PHP Group PHP)
- [CVE-2021-21704](https://cve.now/CVE-2021-21704.md): Multiple vulnerabilities in Firebird client extension (CVSS 5.0, PHP Group PHP)
- [CVE-2021-20725](https://cve.now/CVE-2021-20725.md): Reflected cross-site scripting vulnerability in the admin page of \[Calendar01\] free edition ver1.0.1 and earlier allows a remote attacker to (no CVSS, PHP Factory \[Calendar01\] free edition)
- [CVE-2021-20723](https://cve.now/CVE-2021-20723.md): Reflected cross-site scripting vulnerability in \[MailForm01\] free edition (versions which the last updated date listed at the top of descrip (no CVSS, PHP Factory \[MailForm01\] free edition)
- [CVE-2021-20724](https://cve.now/CVE-2021-20724.md): Reflected cross-site scripting vulnerability in the admin page of \[Telop01\] free edition ver1.0.1 and earlier allows a remote attacker to in (no CVSS, PHP Factory \[Telop01\] free edition)
- [CVE-2021-21702](https://cve.now/CVE-2021-21702.md): Null Dereference in SoapClient (CVSS 5.3, PHP Group PHP)
- [CVE-2020-7071](https://cve.now/CVE-2020-7071.md): FILTER\_VALIDATE\_URL accepts URLs with invalid userinfo (CVSS 5.3, PHP Group PHP)
- [CVE-2020-7070](https://cve.now/CVE-2020-7070.md): PHP parses encoded cookie names so malicious \`\_\_Host-\` cookies can be sent (CVSS 4.3, PHP Group PHP)
- [CVE-2020-7069](https://cve.now/CVE-2020-7069.md): Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV (CVSS 5.4, PHP Group PHP)
- [CVE-2020-7068](https://cve.now/CVE-2020-7068.md): Use of freed hash key in the phar\_parse\_zipfile function (CVSS 4.8, PHP Group PHP)
- [CVE-2020-5616](https://cve.now/CVE-2020-5616.md): \[Calendar01\], \[Calendar02\], \[PKOBO-News01\], \[PKOBO-vote01\], \[Telop01\], \[Gallery01\], \[CalendarForm01\], and \[Link01\] \[Calendar01\] free edition (no CVSS, PHP Factory \[Calendar01\], \[Calendar02\], \[PKOBO-News01\], \[PK…)
- [CVE-2020-5615](https://cve.now/CVE-2020-5615.md): Cross-site request forgery (CSRF) vulnerability in \[Calendar01\] free edition ver1.0.0 and \[Calendar02\] free edition ver1.0.0 allows remote a (no CVSS, PHP Factory \[Calendar01\] and \[Calendar02\])
- [CVE-2019-11048](https://cve.now/CVE-2019-11048.md): Temporary files are not cleaned after OOM when parsing HTTP request data (CVSS 5.3, PHP Group PHP)
- [CVE-2020-7067](https://cve.now/CVE-2020-7067.md): OOB Read in urldecode() (CVSS 7.5, PHP Group PHP)
- [CVE-2020-7066](https://cve.now/CVE-2020-7066.md): get\_headers() silently truncates after a null byte (CVSS 5.3, PHP Group PHP)
- [CVE-2020-7065](https://cve.now/CVE-2020-7065.md): mb\_strtolower (UTF-32LE): stack-buffer-overflow at php\_unicode\_tolower\_full (CVSS 7.4, PHP Group PHP)
- [CVE-2020-7064](https://cve.now/CVE-2020-7064.md): Use-of-uninitialized-value in exif (CVSS 6.5, PHP Group PHP)
- [CVE-2020-7063](https://cve.now/CVE-2020-7063.md): Files added to tar with Phar::buildFromIterator have all-access permissions (CVSS 5.5, PHP Group PHP)
- [CVE-2020-7062](https://cve.now/CVE-2020-7062.md): Null Pointer Dereference in PHP Session Upload Progress (CVSS 7.5, PHP Group PHP)
- [CVE-2020-7061](https://cve.now/CVE-2020-7061.md): heap-buffer-overflow in phar\_extract\_file (CVSS 6.5, PHP Group PHP)
- [CVE-2014-3622](https://cve.now/CVE-2014-3622.md): Use-after-free vulnerability in the add\_post\_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attacker (no CVSS, PHP)
- [CVE-2020-7060](https://cve.now/CVE-2020-7060.md): global buffer-overflow in mbfl\_filt\_conv\_big5\_wchar (CVSS 6.5, PHP Group PHP)
- [CVE-2020-7059](https://cve.now/CVE-2020-7059.md): OOB read in php\_strip\_tags\_ex (CVSS 6.5, PHP Group PHP)
- [CVE-2019-10774](https://cve.now/CVE-2019-10774.md): php-shellcommand versions before 1.6.1 have a command injection vulnerability. (no CVSS, php-shellcommand · mikehaertl/php-shellcommand)
- [CVE-2019-11050](https://cve.now/CVE-2019-11050.md): Use-after-free in exif parsing under memory sanitizer (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11049](https://cve.now/CVE-2019-11049.md): mail() may release string with refcount==1 twice (CVSS 6.5, PHP Group PHP)
- [CVE-2019-11047](https://cve.now/CVE-2019-11047.md): Heap-buffer-overflow READ in exif (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11046](https://cve.now/CVE-2019-11046.md): Buffer underflow in bc\_shift\_addsub (CVSS 3.7, PHP Group PHP)
- [CVE-2019-11045](https://cve.now/CVE-2019-11045.md): DirectoryIterator class silently truncates after a null byte (CVSS 3.7, PHP Group PHP)
- [CVE-2019-11044](https://cve.now/CVE-2019-11044.md): link() silently truncates after a null byte on Windows (CVSS 3.7, PHP Group PHP)
- [CVE-2015-8980](https://cve.now/CVE-2015-8980.md): The plural form formula in ngettext family of calls in php-gettext before 1.0.12 allows remote attackers to execute arbitrary code. (no CVSS, php-gettext)
- [CVE-2019-11043](https://cve.now/CVE-2019-11043.md): Underflow in PHP-FPM can lead to RCE (CVSS 8.7, KEV, PHP)
- [CVE-2019-11042](https://cve.now/CVE-2019-11042.md): heap-buffer-overflow on exif\_process\_user\_comment in EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11041](https://cve.now/CVE-2019-11041.md): heap-buffer-overflow on exif\_scan\_thumbnail in EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-1010028](https://cve.now/CVE-2019-1010028.md): phpscriptsmall.com School College Portal with ERP Script 2.6.1 and earlier is affected by: Cross Site Scripting (XSS). (no CVSS, PHP Scripts Mall Pvt. School College Portal with ERP Script)
- [CVE-2019-11040](https://cve.now/CVE-2019-11040.md): Heap buffer overflow in EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11039](https://cve.now/CVE-2019-11039.md): Out-of-bounds read in iconv.c (CVSS 4.2, PHP Group PHP)
- [CVE-2019-11038](https://cve.now/CVE-2019-11038.md): Uninitialized read in gdImageCreateFromXbm (CVSS 3.1, PHP Group PHP)
- [CVE-2019-11037](https://cve.now/CVE-2019-11037.md): Out of bounds memory write in PHP Imagick extension (CVSS 4.9, PHP Group PHP Imagick extension)
- [CVE-2019-11036](https://cve.now/CVE-2019-11036.md): Heap over-read in PHP EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11035](https://cve.now/CVE-2019-11035.md): Heap over-read in PHP EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2019-11034](https://cve.now/CVE-2019-11034.md): Heap over-read in PHP EXIF extension (CVSS 4.8, PHP Group PHP)
- [CVE-2016-9482](https://cve.now/CVE-2016-9482.md): PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to authentication bypass (no CVSS, PHP FormMail Generator)
- [CVE-2016-9483](https://cve.now/CVE-2016-9483.md): PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted data (no CVSS, PHP FormMail Generator)
- [CVE-2016-9484](https://cve.now/CVE-2016-9484.md): PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder directories and is vulnerable to path traversal (no CVSS, PHP FormMail Generator)
- [CVE-2016-9492](https://cve.now/CVE-2016-9492.md): PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file types (no CVSS, PHP FormMail Generator)
- [CVE-2016-9493](https://cve.now/CVE-2016-9493.md): PHP forms generated using the PHP FormMail Generator are vulnerable to stored cross-site scripting (no CVSS, PHP FormMail Generator)
- [CVE-2016-7479](https://cve.now/CVE-2016-7479.md): In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-af (no CVSS, PHP 7.x)
- [CVE-2016-7480](https://cve.now/CVE-2016-7480.md): The SplObjectStorage unserialize implementation in ext/spl/spl\_observer.c in PHP before 7.0.12 does not verify that a key is an object, whic (no CVSS, PHP before)
- [CVE-2016-7478](https://cve.now/CVE-2016-7478.md): Zend/zend\_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infin (no CVSS, PHP before)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/php
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.