PHP » PHP : Security Vulnerabilities (Execute Code)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

Copy Results Download Results Select Table

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2012-2386	189		DoS Exec Code Overflow	2012-07-07	2012-09-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted tar file that triggers a heap-based buffer overflow.
2	CVE-2012-2376	119	1	Exec Code Overflow	2012-05-21	2012-08-16	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via crafted arguments that trigger incorrect handling of COM object VARIANT types, as exploited in the wild in May 2012.
3	CVE-2012-2335	264		Exec Code Bypass	2012-05-11	2012-08-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgi_main.c component and a query string beginning with a +- sequence.
4	CVE-2012-2311	89		Exec Code Sql	2012-05-11	2012-11-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence but no = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.
5	CVE-2012-1823	20		Exec Code	2012-05-11	2012-11-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.
6	CVE-2012-0830	399		Exec Code	2012-02-06	2012-07-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885.
7	CVE-2011-3379	94		Exec Code	2011-11-03	2012-07-03	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for remote attackers to execute arbitrary code by providing a crafted URL and leveraging potentially unsafe behavior in certain PEAR packages and custom autoloaders.
8	CVE-2011-1938	119	1	Exec Code Overflow	2011-05-31	2012-02-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6 might allow context-dependent attackers to execute arbitrary code via a long pathname for a UNIX socket.
9	CVE-2011-1153	134		DoS Exec Code Mem. Corr. +Info	2011-03-16	2011-10-20	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zend_throw_exception_ex call.
10	CVE-2010-4150	399		DoS Exec Code Mem. Corr.	2010-12-07	2011-07-18	5.0	None	Remote	Low	Not required	None	None	Partial
Double free vulnerability in the imap_do_open function in the IMAP extension (ext/imap/php_imap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.
11	CVE-2010-3064	119		DoS Exec Code Overflow	2010-08-20	2010-12-07	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the php_mysqlnd_auth_write function in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long (1) username or (2) database name argument to the (a) mysql_connect or (b) mysqli_connect function.
12	CVE-2010-2950	134		Exec Code +Info	2010-09-28	2011-05-03	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the phar_stream_flush function, leading to errors in the php_stream_wrapper_log_error function. NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-2094.
13	CVE-2010-2225	399		Exec Code +Info	2010-06-24	2010-12-07	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows remote attackers to execute arbitrary code or obtain sensitive information via serialized data, related to the PHP unserialize function.
14	CVE-2010-2094	134		Exec Code +Info	2010-05-27	2011-01-26	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent attackers to obtain sensitive information (memory contents) and possibly execute arbitrary code via a crafted phar:// URI that is not properly handled by the (1) phar_stream_flush, (2) phar_wrapper_unlink, (3) phar_parse_url, or (4) phar_wrapper_open_url functions in ext/phar/stream.c; and the (5) phar_wrapper_open_dir function in ext/phar/dirstream.c, which triggers errors in the php_stream_wrapper_log_error function.
15	CVE-2010-1868	94		Exec Code	2010-05-07	2010-05-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The (1) sqlite_single_query and (2) sqlite_array_query functions in ext/sqlite/sqlite.c in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allow context-dependent attackers to execute arbitrary code by calling these functions with an empty SQL query, which triggers access of uninitialized memory.
16	CVE-2008-5557	119		Exec Code Overflow	2008-12-23	2010-08-21	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.
17	CVE-2008-3659	119		DoS Exec Code Overflow	2008-08-14	2012-10-30	6.4	None	Remote	Low	Not required	None	Partial	Partial
Buffer overflow in the memnstr function in PHP 4.4.x before 4.4.9 and PHP 5.6 through 5.2.6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via the delimiter argument to the explode function. NOTE: the scope of this issue is limited since most applications would not use an attacker-controlled delimiter, but local attacks against safe_mode are feasible.
18	CVE-2008-3658	119		DoS Exec Code Overflow	2008-08-14	2012-10-30	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the imageloadfont function in ext/gd/gd.c in PHP 4.4.x before 4.4.9 and PHP 5.2 before 5.2.6-r6 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.
19	CVE-2008-2829	119		DoS Exec Code Overflow	2008-06-23	2012-10-30	5.0	None	Remote	Low	Not required	None	None	Partial
php_imap.c in PHP 5.2.5, 5.2.6, 4.x, and other versions, uses obsolete API calls that allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long IMAP request, which triggers an "rfc822.c legacy routine buffer overflow" error message, related to the rfc822_write_address function.
20	CVE-2008-0599			Exec Code	2008-05-05	2012-10-30	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
21	CVE-2007-6039	20		DoS Exec Code	2007-11-20	2008-09-05	2.1	None	Local	Low	Not required	None	None	Partial
PHP 5.2.5 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long string in (1) the domain parameter to the dgettext function, the message parameter to the (2) dcgettext or (3) gettext function, the msgid1 parameter to the (4) dngettext or (5) ngettext function, or (6) the classname parameter to the stream_wrapper_register function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution.
22	CVE-2007-4840	20		DoS Exec Code	2007-09-12	2009-02-05	5.0	None	Remote	Low	Not required	None	None	Partial
PHP 5.2.4 and earlier allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the out_charset parameter to the iconv function; or a long string in the charset parameter to the (2) iconv_mime_decode_headers, (3) iconv_mime_decode, or (4) iconv_strlen function. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
23	CVE-2007-4825	22		Exec Code Dir. Trav. Bypass	2007-09-11	2009-02-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Directory traversal vulnerability in PHP 5.2.4 and earlier allows attackers to bypass open_basedir restrictions and possibly execute arbitrary code via a .. (dot dot) in the dl function.
24	CVE-2007-4784	20		DoS Exec Code	2007-09-10	2009-02-05	5.0	None	Remote	Low	Not required	None	None	Partial
The setlocale function in PHP before 5.2.4 allows context-dependent attackers to cause a denial of service (application crash) via a long string in the locale parameter. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless this issue can be demonstrated for code execution.
25	CVE-2007-4783	20		DoS Exec Code	2007-09-10	2009-02-05	5.0	None	Remote	Low	Not required	None	None	Partial
The iconv_substr function in PHP 5.2.4 and earlier allows context-dependent attackers to cause (1) a denial of service (application crash) via a long string in the charset parameter, probably also requiring a long string in the str parameter; or (2) a denial of service (temporary application hang) via a long string in the str parameter. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
26	CVE-2007-4782	94		DoS Exec Code	2007-09-10	2010-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
PHP before 5.2.3 allows context-dependent attackers to cause a denial of service (application crash) via (1) a long string in the pattern parameter to the glob function; or (2) a long string in the string parameter to the fnmatch function, accompanied by a pattern parameter value with undefined characteristics, as demonstrated by a "*[1]e" value. NOTE: this might not be a vulnerability in most web server environments that support multiple threads, unless these issues can be demonstrated for code execution.
27	CVE-2007-4596	94	1	Exec Code	2007-08-30	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
The perl extension in PHP does not follow safe_mode restrictions, which allows context-dependent attackers to execute arbitrary code via the Perl eval function. NOTE: this might only be a vulnerability in limited environments.
28	CVE-2007-4586	119	1	Exec Code Overflow	2007-08-28	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Multiple buffer overflows in php_iisfunc.dll in the iisfunc extension for PHP 5.2.0 and earlier allow context-dependent attackers to execute arbitrary code, probably during Unicode conversion, as demonstrated by a long string in the first argument to the iis_getservicestate function, related to the ServiceId argument to the (1) fnStartService, (2) fnGetServiceState, (3) fnStopService, and possibly other functions.
29	CVE-2007-4528		1	Exec Code	2007-08-24	2008-09-05	4.3	None	Remote	Medium	Not required	None	Partial	None
The Foreign Function Interface (ffi) extension in PHP 5.0.5 does not follow safe_mode restrictions, which allows context-dependent attackers to execute arbitrary code by loading an arbitrary DLL and calling a function, as demonstrated by kernel32.dll and the WinExec function. NOTE: this issue does not cross privilege boundaries in most contexts, so perhaps it should not be included in CVE.
30	CVE-2007-4507		1	DoS Exec Code Overflow	2007-08-23	2008-09-05	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
Multiple buffer overflows in the php_ntuser component for PHP 5.2.3 allow context-dependent attackers to cause a denial of service or execute arbitrary code via long arguments to the (1) ntuser_getuserlist, (2) ntuser_getuserinfo, (3) ntuser_getusergroups, or (4) ntuser_getdomaincontroller functions.
31	CVE-2007-4441		1	Exec Code Overflow	2007-08-20	2008-09-05	4.6	User	Local	Low	Not required	Partial	Partial	Partial
Buffer overflow in php_win32std.dll in the win32std extension for PHP 5.2.0 and earlier allows context-dependent attackers to execute arbitrary code via a long string in the filename argument to the win_browse_file function.
32	CVE-2007-4255		1	Exec Code Overflow	2007-08-08	2008-09-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the mSQL extension in PHP 5.2.3 allows context-dependent attackers to execute arbitrary code via a long first argument to the msql_connect function.
33	CVE-2007-4033	119	1	Exec Code Overflow	2007-07-27	2010-08-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
34	CVE-2007-4010		1	Exec Code	2007-07-25	2008-09-05	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The win32std extension in PHP 5.2.3 does not follow safe_mode and disable_functions restrictions, which allows remote attackers to execute arbitrary commands via the win_shell_execute function.
35	CVE-2007-3996	189		DoS Exec Code Overflow	2007-09-04	2010-08-21	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
Multiple integer overflows in libgd in PHP before 5.2.4 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large (1) srcW or (2) srcH value to the (a) gdImageCopyResized function, or a large (3) sy (height) or (4) sx (width) value to the (b) gdImageCreate or the (c) gdImageCreateTrueColor function.
36	CVE-2007-3806	399	2	DoS Exec Code Mem. Corr.	2007-07-16	2012-11-05	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The glob function in PHP 5.2.3 allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via an invalid value of the flags parameter, probably related to memory corruption or an invalid read on win32 platforms, and possibly related to lack of initialization for a glob structure.
37	CVE-2007-3378			Exec Code Bypass	2007-06-29	2010-11-22	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
The (1) session_save_path, (2) ini_set, and (3) error_log functions in PHP 4.4.7 and earlier, and PHP 5 5.2.3 and earlier, when invoked from a .htaccess file, allow remote attackers to bypass safe_mode and open_basedir restrictions and possibly execute arbitrary commands, as demonstrated using (a) php_value, (b) php_flag, and (c) directives in .htaccess.
38	CVE-2007-3294	119	1	Exec Code Overflow	2007-06-20	2012-10-30	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Multiple buffer overflows in libtidy, as used in the Tidy extension for PHP 5.2.3 and possibly other products, allow context-dependent attackers to execute arbitrary code via (1) a long second argument to the tidy_parse_string function or (2) an unspecified vector to the tidy_repair_string function. NOTE: this might only be an issue in environments where vsnprintf is implemented as a wrapper for vsprintf.
39	CVE-2007-2872	189		DoS Exec Code Overflow	2007-06-04	2012-10-30	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Multiple integer overflows in the chunk_split function in PHP 5 before 5.2.3 and PHP 4 before 4.4.8 allow remote attackers to cause a denial of service (crash) or execute arbitrary code via the (1) chunks, (2) srclen, and (3) chunklen arguments.
40	CVE-2007-1890			Exec Code Overflow	2007-04-05	2012-11-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in the msg_receive function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1, on FreeBSD and possibly other platforms, allows context-dependent attackers to execute arbitrary code via certain maxsize values, as demonstrated by 0xffffffff.
41	CVE-2007-1889			Exec Code	2007-04-05	2012-11-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Integer signedness error in the _zend_mm_alloc_int function in the Zend Memory Manager in PHP 5.2.0 allows remote attackers to execute arbitrary code via a large emalloc request, related to an incorrect signed long cast, as demonstrated via the HTTP SOAP client in PHP, and via a call to msg_receive with the largest positive integer value of maxsize.
42	CVE-2007-1888			Exec Code Overflow	2007-04-05	2012-11-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the sqlite_decode_binary function in src/encode.c in SQLite 2, as used by PHP 4.x through 5.x and other applications, allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter. NOTE: some PHP installations use a bundled version of sqlite without this vulnerability. The SQLite developer has argued that this issue could be due to a misuse of the sqlite_decode_binary() API.
43	CVE-2007-1887			Exec Code Overflow	2007-04-05	2012-11-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the sqlite_decode_binary function in the bundled sqlite library in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via an empty value of the in parameter, as demonstrated by calling the sqlite_udf_decode_binary function with a 0x01 character.
44	CVE-2007-1885			Exec Code Overflow	2007-04-05	2012-11-05	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in the str_replace function in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 allows context-dependent attackers to execute arbitrary code via a single character search string in conjunction with a long replacement string, which overflows a 32 bit length counter. NOTE: this is probably the same issue as CVE-2007-0906.6.
45	CVE-2007-1884			Exec Code Bypass	2007-04-05	2012-11-05	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
Multiple integer signedness errors in the printf function family in PHP 4 before 4.4.5 and PHP 5 before 5.2.1 on 64 bit machines allow context-dependent attackers to execute arbitrary code via (1) certain negative argument numbers that arise in the php_formatted_print function because of 64 to 32 bit truncation, and bypass a check for the maximum allowable value; and (2) a width and precision of -1, which make it possible for the php_sprintf_appendstring function to place an internal buffer at an arbitrary memory location.
46	CVE-2007-1825			Exec Code Overflow	2007-04-02	2012-11-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the imap_mail_compose function in PHP 5 before 5.2.1, and PHP 4 before 4.4.5, allows remote attackers to execute arbitrary code via a long boundary string in a type.parameters field. NOTE: as of 20070411, it appears that this issue might be subsumed by CVE-2007-0906.3.
47	CVE-2007-1777			Exec Code Overflow	2007-03-29	2012-11-05	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in the zip_read_entry function in PHP 4 before 4.4.5 allows remote attackers to execute arbitrary code via a ZIP archive that contains an entry with a length value of 0xffffffff, which is incremented before use in an emalloc call, triggering a heap overflow.
48	CVE-2007-1711			Exec Code	2007-03-26	2012-11-05	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
Double free vulnerability in the unserializer in PHP 4.4.5 and 4.4.6 allows context-dependent attackers to execute arbitrary code by overwriting variables pointing to (1) the GLOBALS array or (2) the session data in _SESSION. NOTE: this issue was introduced when attempting to patch CVE-2007-1701 (MOPB-31-2007).
49	CVE-2007-1709	119	1	Exec Code Overflow	2007-03-26	2008-09-05	4.3	User	Local	Low	Single system	Partial	Partial	Partial
Buffer overflow in the confirm_phpdoc_compiled function in the phpDOC extension (PECL phpDOC) in PHP 5.2.1 allows context-dependent attackers to execute arbitrary code via a long argument string.
50	CVE-2007-1701			Exec Code	2007-03-26	2012-11-05	6.8	User	Remote	Medium	Not required	Partial	Partial	Partial
PHP 4 before 4.4.5, and PHP 5 before 5.2.1, when register_globals is enabled, allows context-dependent attackers to execute arbitrary code via deserialization of session data, which overwrites arbitrary global variables, as demonstrated by calling session_decode on a string beginning with "_SESSION\|s:39:".

Total number of vulnerabilities : 91 Page : 1 (This Page)2