CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

PHP : Security Vulnerabilities (CVSS score >= 9)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2016-2554 119 DoS Overflow 2016-05-16 2018-01-05
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted TAR archive.
2 CVE-2015-8880 415 2016-05-22 2022-03-01
10.0
 None Remote Low Not required Complete Complete Complete
Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified impact by triggering an error.
3 CVE-2015-8617 134 Exec Code 2016-01-19 2017-09-10
10.0
 None Remote Low Not required Complete Complete Complete
Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
4 CVE-2015-8391 119 DoS Overflow 2015-12-02 2023-02-16
9.0
 None Remote Low Not required Partial Partial Complete
The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
5 CVE-2015-5589 20 DoS 2016-05-16 2017-11-04
10.0
 None Remote Low Not required Complete Complete Complete
The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not validate a file pointer before a close operation, which allows remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted TAR archive that is mishandled in a Phar::convertToData call.
6 CVE-2015-4603 Exec Code 2016-05-16 2019-04-22
10.0
 None Remote Low Not required Complete Complete Complete
The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
7 CVE-2015-4602 DoS Exec Code 2016-05-16 2019-04-22
10.0
 None Remote Low Not required Complete Complete Complete
The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
8 CVE-2015-4601 DoS Exec Code 2016-05-16 2018-01-05
10.0
 None Remote Low Not required Complete Complete Complete
PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in (1) ext/soap/php_encoding.c, (2) ext/soap/php_http.c, and (3) ext/soap/soap.c, a different issue than CVE-2015-4600.
9 CVE-2015-4600 DoS Exec Code 2016-05-16 2018-01-05
10.0
 None Remote Low Not required Complete Complete Complete
The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type confusion" issues in the (1) SoapClient::__getLastRequest, (2) SoapClient::__getLastResponse, (3) SoapClient::__getLastRequestHeaders, (4) SoapClient::__getLastResponseHeaders, (5) SoapClient::__getCookies, and (6) SoapClient::__setCookie methods.
10 CVE-2015-4599 DoS Exec Code +Info 2016-05-16 2018-01-05
10.0
 None Remote Low Not required Complete Complete Complete
The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information, cause a denial of service (application crash), or possibly execute arbitrary code via an unexpected data type, related to a "type confusion" issue.
11 CVE-2015-0235 787 Exec Code Overflow 2015-01-28 2022-07-05
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
12 CVE-2012-2688 Overflow 2012-07-20 2017-12-22
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has unknown impact and remote attack vectors, related to an "overflow."
13 CVE-2011-3268 119 Overflow 2011-08-25 2017-08-29
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspecified impact via a long salt argument, a different vulnerability than CVE-2011-2483.
14 CVE-2009-4143 2009-12-21 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
PHP before 5.2.12 does not properly handle session data, which has unspecified impact and attack vectors related to (1) interrupt corruption of the SESSION superglobal array and (2) the session.save_path directive.
15 CVE-2009-3546 119 Overflow 2009-10-19 2023-02-13
9.3
 None Remote Medium Not required Complete Complete Complete
The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, does not properly verify a certain colorsTotal structure member, which might allow remote attackers to conduct buffer overflow or buffer over-read attacks via a crafted GD file, a different vulnerability than CVE-2009-3293. NOTE: some of these details are obtained from third party information.
16 CVE-2008-5557 119 Exec Code Overflow 2008-12-23 2018-10-11
10.0
 None Remote Low Not required Complete Complete Complete
Heap-based buffer overflow in ext/mbstring/libmbfl/filters/mbfilter_htmlent.c in the mbstring extension in PHP 4.3.0 through 5.2.6 allows context-dependent attackers to execute arbitrary code via a crafted string containing an HTML entity, which is not properly handled during Unicode conversion, related to the (1) mb_convert_encoding, (2) mb_check_encoding, (3) mb_convert_variables, and (4) mb_parse_str functions.
17 CVE-2008-2051 2008-05-05 2018-10-11
10.0
 None Remote Low Not required Complete Complete Complete
The escapeshellcmd API function in PHP before 5.2.6 has unknown impact and context-dependent attack vectors related to "incomplete multibyte chars."
18 CVE-2008-2050 119 Overflow 2008-05-05 2023-02-13
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the FastCGI SAPI (fastcgi.c) in PHP before 5.2.6 has unknown impact and attack vectors.
19 CVE-2008-0599 Exec Code 2008-05-05 2018-10-15
10.0
 None Remote Low Not required Complete Complete Complete
The init_request_info function in sapi/cgi/cgi_main.c in PHP before 5.2.6 does not properly consider operator precedence when calculating the length of PATH_TRANSLATED, which might allow remote attackers to execute arbitrary code via a crafted URI.
20 CVE-2007-5653 78 Bypass 2007-10-23 2017-09-29
9.3
 None Remote Medium Not required Complete Complete Complete
The Component Object Model (COM) functions in PHP 5.x on Windows do not follow safe_mode and disable_functions restrictions, which allows context-dependent attackers to bypass intended limitations, as demonstrated by executing objects with the kill bit set in the corresponding ActiveX control Compatibility Flags, executing programs via a function in compatUI.dll, invoking wscript.shell via wscript.exe, invoking Scripting.FileSystemObject via wshom.ocx, and adding users via a function in shgina.dll, related to the com_load_typelib function.
21 CVE-2007-2844 2007-05-24 2018-10-30
9.3
 None Remote Medium Not required Complete Complete Complete
PHP 4.x and 5.x before 5.2.1, when running on multi-threaded systems, does not ensure thread safety for libc crypt function calls using protection schemes such as a mutex, which creates race conditions that allow remote attackers to overwrite internal program memory and gain system access.
22 CVE-2007-1581 94 Exec Code 2007-03-21 2018-10-30
9.3
 None Remote Medium Not required Complete Complete Complete
The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by interrupting the hash_update_file function via a userspace (1) error or (2) stream handler, which can then be used to destroy and modify internal resources. NOTE: it was later reported that PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 are also affected.
23 CVE-2007-1399 Exec Code Overflow 2007-03-10 2017-07-29
10.0
 None Remote Low Not required Complete Complete Complete
Stack-based buffer overflow in the zip:// URL wrapper in PECL ZIP 1.8.3 and earlier, as bundled with PHP 5.2.0 and 5.2.1, allows remote attackers to execute arbitrary code via a long zip:// URL, as demonstrated by actively triggering URL access from a remote PHP interpreter via avatar upload or blog pingback.
24 CVE-2007-1383 189 Exec Code Overflow 2007-03-10 2008-09-05
10.0
 None Remote Low Not required Complete Complete Complete
Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this counter, which causes the same variable to be destroyed twice, a related issue to CVE-2007-1286.
25 CVE-2007-0910 2007-02-13 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
Unspecified vulnerability in PHP before 5.2.1 allows attackers to "clobber" certain super-global variables via unspecified vectors.
26 CVE-2007-0448 Bypass 2007-05-24 2008-09-11
10.0
 None Remote Low Not required Complete Complete Complete
The fopen function in PHP 5.2.0 does not properly handle invalid URI handlers, which allows context-dependent attackers to bypass safe_mode restrictions and read arbitrary files via a file path specified with an invalid URI, as demonstrated via the srpath URI.
27 CVE-2006-4812 94 Exec Code Overflow 2006-10-10 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote attackers to execute arbitrary code via an argument to the unserialize PHP function with a large value for the number of array elements, which triggers the overflow in the Zend Engine ecalloc function (Zend/zend_alloc.c).
28 CVE-2006-4485 2006-08-31 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
The stripos function in PHP before 5.1.5 has unknown impact and attack vectors related to an out-of-bounds read.
29 CVE-2006-4483 862 2006-08-31 2022-07-19
9.3
 None Remote Medium Not required Complete Complete Complete
The cURL extension files (1) ext/curl/interface.c and (2) ext/curl/streams.c in PHP before 5.1.5 permit the CURLOPT_FOLLOWLOCATION option when open_basedir or safe_mode is enabled, which allows attackers to perform unauthorized actions, possibly related to the realpath cache.
30 CVE-2006-4482 787 Overflow 2006-08-31 2022-07-19
9.3
 None Remote Medium Not required Complete Complete Complete
Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when used on a 64-bit system, have unspecified impact and attack vectors, a different vulnerability than CVE-2006-1990.
31 CVE-2006-3017 2006-06-14 2018-10-30
9.3
 None Remote Medium Not required Complete Complete Complete
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
32 CVE-2006-1017 2006-03-07 2018-10-30
9.3
 None Remote Medium Not required Complete Complete Complete
The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the (1) safe_mode or (2) open_basedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imap_open function, allow remote attackers to obtain access to an IMAP stream data structure and conduct unauthorized IMAP actions.
33 CVE-2006-0200 134 Exec Code 2006-01-13 2018-10-30
9.3
 None Remote Medium Not required Complete Complete Complete
Format string vulnerability in the error-reporting feature in the mysqli extension in PHP 5.1.0 and 5.1.1 might allow remote attackers to execute arbitrary code via format string specifiers in MySQL error messages.
34 CVE-2004-1065 Exec Code Overflow 2005-01-10 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.
35 CVE-2004-1064 Bypass 2005-01-10 2020-12-08
10.0
 None Remote Low Not required Complete Complete Complete
The safe mode checks in PHP 4.x to 4.3.9 and PHP 5.x to 5.0.2 truncate the file path before passing the data to the realpath function, which could allow attackers to bypass safe mode. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
36 CVE-2004-1063 Exec Code Bypass 2005-01-10 2020-12-08
10.0
 None Remote Low Not required Complete Complete Complete
PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a multithreaded Unix webserver, allows local users to bypass safe_mode_exec_dir restrictions and execute commands outside of the intended safe_mode_exec_dir via shell metacharacters in the current directory name. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
37 CVE-2004-1019 20 DoS Exec Code 2005-01-10 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
The deserialization code in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to cause a denial of service and execute arbitrary code via untrusted data to the unserialize function that may trigger "information disclosure, double-free and negative reference index array underflow" results.
38 CVE-2004-1018 DoS Exec Code Overflow Bypass 2005-01-10 2020-12-08
10.0
 None Remote Low Not required Complete Complete Complete
Multiple integer handling errors in PHP before 4.3.10 allow attackers to bypass safe mode restrictions, cause a denial of service, or execute arbitrary code via (1) a negative offset value to the shmop_write function, (2) an "integer overflow/underflow" in the pack function, or (3) an "integer overflow/underflow" in the unpack function. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion.
39 CVE-2004-0542 Exec Code 2004-08-06 2022-07-01
10.0
 None Remote Low Not required Complete Complete Complete
PHP before 4.3.7 on Win32 platforms does not properly filter all shell metacharacters, which allows local or remote attackers to execute arbitrary code, overwrite files, and access internal environment variables via (1) the "%", "|", or ">" characters to the escapeshellcmd function, or (2) the "%" character to the escapeshellarg function.
40 CVE-2003-0861 Overflow 2003-11-17 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
Integer overflows in (1) base64_encode and (2) the GD library for PHP before 4.3.3 have unknown impact and unknown attack vectors.
41 CVE-2003-0860 Overflow 2003-11-17 2018-10-30
10.0
 None Remote Low Not required Complete Complete Complete
Buffer overflows in PHP before 4.3.3 have unknown impact and unknown attack vectors.
42 CVE-2000-0967 Exec Code 2000-12-19 2018-05-03
10.0
 None Remote Low Not required Complete Complete Complete
PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.
43 CVE-2000-0059 Exec Code 2000-01-04 2008-09-10
10.0
 None Remote Low Not required Complete Complete Complete
PHP3 with safe_mode enabled does not properly filter shell metacharacters from commands that are executed by popen, which could allow remote attackers to execute commands.
44 CVE-1999-0238 1997-08-01 2022-08-17
10.0
 None Remote Low Not required Complete Complete Complete
php.cgi allows attackers to read any file on the system.
Total number of vulnerabilities : 44   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.