PHP Web programming language
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any PHP product.
RSS Feeds for PHP security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in PHP products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by PHP Sorted by Most Security Vulnerabilities since 2018
Recent PHP Security Advisories
| Advisory | Title | Published |
|---|---|---|
| 8.2.28 | 5 Vulnerabilities Fixed in PHP 8.2.28 | March 13, 2025 |
| 8.1.32 | 5 Vulnerabilities Fixed in PHP 8.1.32 | March 13, 2025 |
| 8.4.5 | 6 Vulnerabilities Fixed in PHP 8.4.5 | March 13, 2025 |
| 8.3.19 | 6 Vulnerabilities Fixed in PHP 8.3.19 | March 13, 2025 |
| 8.1.31 | 6 Vulnerabilities Fixed in PHP 8.1.31 | November 21, 2024 |
| 8.3.14 | 6 Vulnerabilities Fixed in PHP 8.3.14 | November 21, 2024 |
| 8.2.26 | 6 Vulnerabilities Fixed in PHP 8.2.26 | November 21, 2024 |
| 8.1.30 | 4 Vulnerabilities Fixed in PHP 8.1.30 | September 26, 2024 |
| 8.3.12 | 4 Vulnerabilities Fixed in PHP 8.3.12 | September 26, 2024 |
| 8.2.24 | 4 Vulnerabilities Fixed in PHP 8.2.24 | September 26, 2024 |
Known Exploited PHP Vulnerabilities
The following PHP vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability |
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution. CVE-2019-11043 Exploit Probability: 94.1% |
March 25, 2022 |
| PHP-CGI Query String Parameter Vulnerability |
sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code. CVE-2012-1823 Exploit Probability: 94.4% |
March 25, 2022 |
Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.
By the Year
In 2025 there have been 6 vulnerabilities in PHP with an average score of 5.5 out of ten. Last year, in 2024 PHP had 18 security vulnerabilities published. Right now, PHP is on track to have less security vulnerabilities in 2025 than it did last year. Last year, the average CVE base score was greater by 1.76
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 6 | 5.50 |
| 2024 | 18 | 7.26 |
| 2023 | 7 | 6.99 |
| 2022 | 11 | 8.62 |
| 2021 | 8 | 6.36 |
| 2020 | 16 | 6.66 |
| 2019 | 31 | 8.13 |
| 2018 | 22 | 7.49 |
It may take a day or so for new PHP vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent PHP Security Vulnerabilities
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5,
CVE-2024-11235
8.1 - High
- April 04, 2025
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
Dangling pointer
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f
CVE-2025-1734
- March 30, 2025
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when receiving headers from HTTP server, the headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f
CVE-2025-1861
- March 30, 2025
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f
CVE-2025-1736
- March 30, 2025
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted.
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f
CVE-2025-1219
5.3 - Medium
- March 30, 2025
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, f
CVE-2025-1217
3.1 - Low
- March 29, 2025
In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when http request module parses HTTP response obtained from a server, folded headers are parsed incorrectly, which may lead to misinterpreting the response and using incorrect headers, MIME types, etc.
Interpretation Conflict
PHP convert.quoted-printable-decode Filter Buffer Overread Vulnerability
CVE-2024-11233
8.2 - High
- November 24, 2024
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, due to an error in convert.quoted-printable-decode filter certain data can lead to buffer overread by one byte, which can in certain circumstances lead to crashes or disclose content of other memory areas.
Memory Corruption
PHP Stream Proxy Request Smuggling Vulnerability
CVE-2024-11234
7.2 - High
- November 24, 2024
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
Injection
PHP ldap_escape() Integer Overflow Vulnerability on 32-bit Systems
CVE-2024-11236
9.8 - Critical
- November 24, 2024
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
Integer Overflow or Wraparound
PHP MySQL Client Heap Disclosure Vulnerability
CVE-2024-8929
- November 22, 2024
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server.
PHP ldap_escape() Integer Overflow Vulnerability on 32-bit Systems
CVE-2024-8932
- November 22, 2024
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-9026
3.3 - Low
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-8927
7.5 - High
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-8926
8.8 - High
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-8925
5.3 - Medium
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-9026
3.3 - Low
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-8927
7.5 - High
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-8926
8.8 - High
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-8925
5.3 - Medium
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-9026
3.3 - Low
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-8927
7.5 - High
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-8926
8.8 - High
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.
CVE-2024-8925
5.3 - Medium
- October 08, 2024
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-4577
9.8 - Critical
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-4577
9.8 - Critical
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-4577
9.8 - Critical
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version
CVE-2024-2408
5.9 - Medium
- June 09, 2024
The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable. PHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.
Side Channel Attack
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-4577
9.8 - Critical
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-4577
9.8 - Critical
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-4577
9.8 - Critical
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-4577
9.8 - Critical
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Shell injection
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-5458
5.3 - Medium
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
Insufficient Verification of Data Authenticity
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-5585
8.8 - High
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Output Sanitization
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-5458
5.3 - Medium
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
Insufficient Verification of Data Authenticity
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-5585
8.8 - High
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Output Sanitization
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-5458
5.3 - Medium
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
Insufficient Verification of Data Authenticity
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-5585
8.8 - High
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Output Sanitization
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-5585
8.8 - High
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Output Sanitization
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.
CVE-2024-5458
5.3 - Medium
- June 09, 2024
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
Insufficient Verification of Data Authenticity
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.
CVE-2024-1874
- April 29, 2024
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.
CVE-2024-3096
- April 29, 2024
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser
CVE-2024-2756
- April 29, 2024
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.
CVE-2024-1874
- April 29, 2024
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.
CVE-2024-1874
- April 29, 2024
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser
CVE-2024-2756
- April 29, 2024
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() r
CVE-2024-2757
- April 29, 2024
In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses this function.
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.
CVE-2024-3096
- April 29, 2024
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser
CVE-2024-2756
- April 29, 2024
Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications.
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.
CVE-2024-1874
- April 29, 2024
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.
CVE-2024-1874
- April 29, 2024
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.