Skip to content
Fencer Intel

All · PHP

Newest first, late arrivals on top. Also a feed.

  1. 5.0
    CVE-2015-4021 The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that th…
    PHP
    EPSS 20.5% chance of exploitation in 30 days, percentile 97%
  2. 6.8
    CVE-2015-3330 The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the…
    PHP
    EPSS 13.5% chance of exploitation in 30 days, percentile 96%
  3. 7.5
    CVE-2015-3329 Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.…
    PHP
    EPSS 38.2% chance of exploitation in 30 days, percentile 98%
  4. 7.5
    CVE-2015-3307 The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attacke…
    PHP
    EPSS 6.7% chance of exploitation in 30 days, percentile 93%
  5. 5.8
    CVE-2015-2783 ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information f…
    PHP
    EPSS 9.0% chance of exploitation in 30 days, percentile 95%
  6. 7.5
    CVE-2015-3416 The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point c…
    PHP
    EPSS 5.4% chance of exploitation in 30 days, percentile 92%
  7. 7.5
    CVE-2015-3415 The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-depend…
    PHP
    EPSS 4.1% chance of exploitation in 30 days, percentile 91%
  8. 7.5
    CVE-2015-3414 SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to caus…
    PHP
    EPSS 4.1% chance of exploitation in 30 days, percentile 91%
  9. 7.5
    CVE-2015-2787 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5…
    PHP
    EPSS 11.8% chance of exploitation in 30 days, percentile 96%
  10. 5.0
    CVE-2015-2348 The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 t…
    PHP
    EPSS 8.3% chance of exploitation in 30 days, percentile 94%
  11. 7.5
    CVE-2015-2331 Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZIP extension in PHP before 5.4…
    PHP
    EPSS 27.4% chance of exploitation in 30 days, percentile 98%
  12. 6.8
    CVE-2015-2305 Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as u…
    PHP
    EPSS 8.9% chance of exploitation in 30 days, percentile 95%
  13. 7.5
    CVE-2015-2301 Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote…
    PHP
    EPSS 14.7% chance of exploitation in 30 days, percentile 96%
  14. 5.0
    CVE-2015-1352 The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate token extraction for…
    PHP
    EPSS 6.6% chance of exploitation in 30 days, percentile 93%
  15. 7.5
    CVE-2015-1351 Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allow…
    PHP
    EPSS 8.3% chance of exploitation in 30 days, percentile 95%
  16. 7.5
    CVE-2015-0273 Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remo…
    PHP
    1 public exploit EPSS 42.8% chance of exploitation in 30 days, percentile 98%
  17. 5.0
    CVE-2014-9709 The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers…
    PHP
    EPSS 15.4% chance of exploitation in 30 days, percentile 96%
  18. 7.5
    CVE-2014-9705 Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22,…
    PHP
    EPSS 19.2% chance of exploitation in 30 days, percentile 97%
  19. 7.5
    CVE-2014-9653 readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does no…
    PHP
    EPSS 4.6% chance of exploitation in 30 days, percentile 91%
  20. 5.0
    CVE-2014-9652 The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and…
    PHP
    EPSS 5.2% chance of exploitation in 30 days, percentile 92%
  21. 4.6
    CVE-2013-6501 The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp direc…
    PHP
  22. 10.0
    CVE-2015-0235 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-depe…
    PHP
    4 public exploits EPSS 94.6% chance of exploitation in 30 days, percentile 99.8%
  23. 6.8
    CVE-2015-0232 The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attack…
    PHP
    EPSS 15.6% chance of exploitation in 30 days, percentile 96%
  24. 7.5
    CVE-2015-0231 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5…
    PHP
    EPSS 44.4% chance of exploitation in 30 days, percentile 98%
  25. 7.5
    CVE-2014-9427 sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4, when mmap is used to read a…
    PHP
    EPSS 18.3% chance of exploitation in 30 days, percentile 97%
  26. 7.3
    CVE-2014-9426 The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts to perform a free operation o…
    PHP
    EPSS 2.1% chance of exploitation in 30 days, percentile 82%
  27. 7.5
    CVE-2014-9425 Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine in PHP through 5.5.20 and 5.6.…
    PHP
    EPSS 3.7% chance of exploitation in 30 days, percentile 89%
  28. 7.5
    CVE-2014-8142 Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5…
    PHP
    EPSS 55.1% chance of exploitation in 30 days, percentile 99%
  29. 7.5
    CVE-2014-8626 Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers…
    PHP
    EPSS 5.8% chance of exploitation in 30 days, percentile 93%
  30. 5.0
    CVE-2014-3710 The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient not…
    PHP
    EPSS 14.0% chance of exploitation in 30 days, percentile 96%