Skip to content
Fencer Intel

All · PHP

Newest first, late arrivals on top. Also a feed.

  1. 5.0
    CVE-2012-1171 The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files v…
    PHP
    EPSS 2.8% chance of exploitation in 30 days, percentile 86%
  2. 7.5
    CVE-2013-6420 The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not proper…
    PHP
    1 public exploit EPSS 35.4% chance of exploitation in 30 days, percentile 98%
  3. 5.0
    CVE-2013-6712 The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creation of DateInterval objects, w…
    PHP
    EPSS 4.6% chance of exploitation in 30 days, percentile 91%
  4. 4.3
    CVE-2013-1824 The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containin…
    PHP
    EPSS 4.3% chance of exploitation in 30 days, percentile 91%
  5. 4.3
    CVE-2013-4248 The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '…
    PHP
    EPSS 3.3% chance of exploitation in 30 days, percentile 88%
  6. 6.8
    CVE-2011-4718 Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack web sessions by specifying a…
    PHP
    EPSS 3.6% chance of exploitation in 30 days, percentile 89%
  7. 6.8
    CVE-2013-4113 ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to cause a denial of service (he…
    PHP
    EPSS 5.2% chance of exploitation in 30 days, percentile 92%
  8. 4.3
    CVE-2013-4636 The mget function in libmagic/softmagic.c in the Fileinfo component in PHP 5.4.x before 5.4.16 allows remote attackers to cause a denial of…
    PHP
    EPSS 2.0% chance of exploitation in 30 days, percentile 80%
  9. 5.0
    CVE-2013-4635 Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.4.x before 5.4.16 allows cont…
    PHP
    EPSS 4.2% chance of exploitation in 30 days, percentile 91%
  10. 5.0
    CVE-2013-2110 Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.3.26 and 5.4.x before 5.4.16…
    PHP
    EPSS 6.7% chance of exploitation in 30 days, percentile 94%
  11. 7.5
    CVE-2013-3735 The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser error occurred, which allows c…
    PHP
    EPSS 2.8% chance of exploitation in 30 days, percentile 86%
  12. 5.0
    CVE-2013-1643 The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containin…
    PHP
    EPSS 10.1% chance of exploitation in 30 days, percentile 95%
  13. 7.5
    CVE-2013-1635 ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive a…
    PHP
    EPSS 9.4% chance of exploitation in 30 days, percentile 95%
  14. 5.0
    CVE-2012-6113 The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remo…
    PHP
    EPSS 2.5% chance of exploitation in 30 days, percentile 85%
  15. 6.0
    CVE-2012-5381 Untrusted search path vulnerability in the installation functionality in PHP 5.3.17, when installed in the top-level C:\ directory, might a…
    PHP
    1 public exploit
  16. 4.3
    CVE-2012-4388 The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer during checks for %0D sequen…
    PHP
    EPSS 4.2% chance of exploitation in 30 days, percentile 91%
  17. 4.3
    CVE-2011-1398 The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %0D sequences (aka carriage re…
    PHP
    1 public exploit EPSS 10.2% chance of exploitation in 30 days, percentile 95%
  18. 2.6
    CVE-2012-3450 pdo_sql_parser.re in the PDO extension in PHP before 5.3.14 and 5.4.x before 5.4.4 does not properly determine the end of the query string…
    PHP
    1 public exploit EPSS 11.2% chance of exploitation in 30 days, percentile 96%
  19. 5.0
    CVE-2012-3365 The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vecto…
    PHP
    EPSS 3.0% chance of exploitation in 30 days, percentile 87%
  20. 10.0
    CVE-2012-2688 Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has…
    PHP
    EPSS 10.5% chance of exploitation in 30 days, percentile 95%
  21. 7.5
    CVE-2012-2386 Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.4.x before 5.4.4 allows remot…
    PHP
    1 public exploit EPSS 42.1% chance of exploitation in 30 days, percentile 98%
  22. 4.3
    CVE-2012-2143 The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not pro…
    PostgreSQLPHP
    EPSS 5.7% chance of exploitation in 30 days, percentile 93%
  23. 5.8
    CVE-2012-1172 The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name…
    PHP
    EPSS 6.2% chance of exploitation in 30 days, percentile 93%
  24. 10.0
    CVE-2012-2376 Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code vi…
    PHP
    1 public exploit EPSS 19.8% chance of exploitation in 30 days, percentile 97%
  25. 5.0
    CVE-2012-2336 sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle qu…
    PHP
    4 public exploits EPSS 52.1% chance of exploitation in 30 days, percentile 98%
  26. 7.5
    CVE-2012-2335 php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3…
    PHP
    EPSS 33.7% chance of exploitation in 30 days, percentile 98%
  27. 5.0
    CVE-2012-2329 Buffer overflow in the apache_request_headers function in sapi/cgi/cgi_main.c in PHP 5.4.x before 5.4.3 allows remote attackers to cause a…
    PHP
    2 public exploits EPSS 61.9% chance of exploitation in 30 days, percentile 99.1%
  28. 7.5
    CVE-2012-2311 sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle qu…
    PHP
    4 public exploits EPSS 69.3% chance of exploitation in 30 days, percentile 99.3%
  29. 9.8
    CVE-2012-1823 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle qu…
    PHP
    kev 5 public exploits EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
  30. 5.0
    CVE-2012-0789 Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by…
    PHP
    1 public exploit EPSS 8.0% chance of exploitation in 30 days, percentile 94%