Skip to content
Fencer Intel

All · PHP

Newest first, late arrivals on top. Also a feed.

  1. 9.8
    CVE-2016-4071 Format string vulnerability in the php_snmp_error function in ext/snmp/snmp.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0…
    PHP
    1 public exploit EPSS 20.5% chance of exploitation in 30 days, percentile 97%
  2. 7.5
    CVE-2016-4070 Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5.6.20, and 7.x before 7.0.5 a…
    PHP
    EPSS 5.7% chance of exploitation in 30 days, percentile 93%
  3. 7.3
    CVE-2015-8865 The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.5.34, 5.6.x before 5.6.20, an…
    PHP
    EPSS 5.5% chance of exploitation in 30 days, percentile 92%
  4. 7.1
    CVE-2016-3185 The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, 5.6.x before 5.6.12, and 7.x before 7…
    PHP
    EPSS 3.1% chance of exploitation in 30 days, percentile 88%
  5. 9.8
    CVE-2016-2554 Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 allows remote attackers to ca…
    PHP
    EPSS 11.0% chance of exploitation in 30 days, percentile 95%
  6. 7.5
    CVE-2015-8874 Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of service via a crafted imagefilltobo…
    PHP
    EPSS 8.6% chance of exploitation in 30 days, percentile 95%
  7. 7.5
    CVE-2015-8873 Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote…
    PHP
    EPSS 3.8% chance of exploitation in 30 days, percentile 90%
  8. 5.9
    CVE-2015-8838 ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optio…
    PHP
    EPSS 1.7% chance of exploitation in 30 days, percentile 78%
  9. 9.8
    CVE-2015-8835 The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not prop…
    PHP
    EPSS 6.2% chance of exploitation in 30 days, percentile 93%
  10. 7.5
    CVE-2015-6838 The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxm…
    PHP
    EPSS 8.1% chance of exploitation in 30 days, percentile 94%
  11. 7.5
    CVE-2015-6837 The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13, when libxm…
    PHP
    EPSS 7.3% chance of exploitation in 30 days, percentile 94%
  12. 9.8
    CVE-2015-6835 The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multiple php_var_unserialize calls,…
    PHP
    1 public exploit EPSS 36.2% chance of exploitation in 30 days, percentile 98%
  13. 9.8
    CVE-2015-6834 Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 allow remote attackers to execut…
    PHP
    2 public exploits EPSS 46.8% chance of exploitation in 30 days, percentile 98%
  14. 9.8
    CVE-2015-5589 The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 does not va…
    PHP
    EPSS 6.3% chance of exploitation in 30 days, percentile 93%
  15. 7.5
    CVE-2015-4644 The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x be…
    PHP
    EPSS 5.3% chance of exploitation in 30 days, percentile 92%
  16. 9.8
    CVE-2015-4643 Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows rem…
    PHP
    EPSS 15.4% chance of exploitation in 30 days, percentile 96%
  17. 9.8
    CVE-2015-4642 The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows rem…
    PHP
    EPSS 6.0% chance of exploitation in 30 days, percentile 93%
  18. 7.5
    CVE-2015-4605 The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x befor…
    PHP
    EPSS 7.1% chance of exploitation in 30 days, percentile 94%
  19. 7.5
    CVE-2015-4604 The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before…
    PHP
    EPSS 7.1% chance of exploitation in 30 days, percentile 94%
  20. 9.8
    CVE-2015-4603 The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows…
    PHP
    EPSS 10.6% chance of exploitation in 30 days, percentile 95%
  21. 9.8
    CVE-2015-4602 The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 al…
    PHP
    EPSS 10.3% chance of exploitation in 30 days, percentile 95%
  22. 9.8
    CVE-2015-4601 PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an un…
    PHP
    EPSS 7.9% chance of exploitation in 30 days, percentile 94%
  23. 9.8
    CVE-2015-4600 The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial o…
    PHP
    EPSS 10.3% chance of exploitation in 30 days, percentile 95%
  24. 9.8
    CVE-2015-4599 The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attacke…
    PHP
    EPSS 10.3% chance of exploitation in 30 days, percentile 95%
  25. 6.5
    CVE-2015-4598 PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote…
    PHP
    EPSS 3.8% chance of exploitation in 30 days, percentile 90%
  26. 9.8
    CVE-2015-4116 Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows…
    PHP
    EPSS 5.5% chance of exploitation in 30 days, percentile 92%
  27. 5.3
    CVE-2015-3412 PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote…
    PHP
    EPSS 3.9% chance of exploitation in 30 days, percentile 90%
  28. 6.5
    CVE-2015-3411 PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote…
    PHP
    EPSS 3.3% chance of exploitation in 30 days, percentile 88%
  29. 5.9
    CVE-2015-3152 Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient) before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to me…
    MySQLMariaDBPHP
    EPSS 7.1% chance of exploitation in 30 days, percentile 94%
  30. 7.5
    CVE-2014-0236 file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer…
    PHP
    EPSS 2.5% chance of exploitation in 30 days, percentile 85%