Skip to content
Fencer Intel

All · PHP

Newest first, late arrivals on top. Also a feed.

  1. 7.0
    CVE-2017-9067 MODX Revolution Directory Traversal Vulnerability
    PHPpackagist
  2. 9.8
    CVE-2017-8923 The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a nega…
    PHP
    EPSS 7.2% chance of exploitation in 30 days, percentile 94%
  3. 7.8
    CVE-2016-5399 The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows remote attackers to cause a den…
    PHP
    1 public exploit EPSS 9.8% chance of exploitation in 30 days, percentile 95%
  4. 7.5
    CVE-2017-7963 The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory c…
    PHP
    EPSS 2.0% chance of exploitation in 30 days, percentile 81%
  5. 7.5
    CVE-2017-6441 The _zval_get_long_func_ex in Zend/zend_operators.c in PHP 7.1.2 allows attackers to cause a denial of service (NULL pointer dereference an…
    PHP
    EPSS 1.8% chance of exploitation in 30 days, percentile 79%
  6. 7.4
    CVE-2017-7272 PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argument with an expectation that…
    PHP
    EPSS 3.5% chance of exploitation in 30 days, percentile 89%
  7. 7.5
    CVE-2015-8994 An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled.
    PHP
    EPSS 2.9% chance of exploitation in 30 days, percentile 87%
  8. 7.5
    CVE-2016-10162 The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a d…
    PHP
    EPSS 5.9% chance of exploitation in 30 days, percentile 93%
  9. 7.5
    CVE-2016-10161 The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows rem…
    PHP
    EPSS 13.3% chance of exploitation in 30 days, percentile 96%
  10. 9.8
    CVE-2016-10160 Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attacker…
    PHP
    EPSS 7.4% chance of exploitation in 30 days, percentile 94%
  11. 7.5
    CVE-2016-10159 Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attacker…
    PHP
    EPSS 7.6% chance of exploitation in 30 days, percentile 94%
  12. 7.5
    CVE-2016-10158 The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote att…
    PHP
    EPSS 7.8% chance of exploitation in 30 days, percentile 94%
  13. 9.8
    CVE-2016-7479 In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-a…
    PHP
    EPSS 41.7% chance of exploitation in 30 days, percentile 98%
  14. 9.8
    CVE-2016-7480 The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, whi…
    PHP
    EPSS 41.6% chance of exploitation in 30 days, percentile 98%
  15. 9.8
    CVE-2017-5340 Zend/zend_hash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows re…
    PHP
    EPSS 16.7% chance of exploitation in 30 days, percentile 97%
  16. 7.5
    CVE-2016-7478 Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infi…
    PHP
    EPSS 42.4% chance of exploitation in 30 days, percentile 98%
  17. 9.8
    CVE-2016-9936 The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-aft…
    PHP
    EPSS 4.3% chance of exploitation in 30 days, percentile 91%
  18. 9.8
    CVE-2016-9935 The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial…
    PHP
    EPSS 7.0% chance of exploitation in 30 days, percentile 94%
  19. 7.5
    CVE-2016-9934 ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference)…
    PHP
    EPSS 6.8% chance of exploitation in 30 days, percentile 94%
  20. 9.8
    CVE-2016-9138 PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which allows remote attackers to cau…
    PHP
    EPSS 3.8% chance of exploitation in 30 days, percentile 90%
  21. 9.8
    CVE-2016-9137 Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remot…
    PHP
    EPSS 5.3% chance of exploitation in 30 days, percentile 92%
  22. 9.8
    CVE-2014-9912 The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5…
    PHP
    EPSS 4.9% chance of exploitation in 30 days, percentile 92%
  23. 9.8
    CVE-2016-7568 Integer overflow in the gdImageWebpCtx function in gd_webp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP through 7…
    PHP
    EPSS 5.1% chance of exploitation in 30 days, percentile 92%
  24. 7.5
    CVE-2016-7418 The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote attackers to cause a denial…
    PHP
    EPSS 11.4% chance of exploitation in 30 days, percentile 96%
  25. 9.8
    CVE-2016-7417 ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without validating a return value and…
    PHP
    EPSS 6.8% chance of exploitation in 30 days, percentile 94%
  26. 7.5
    CVE-2016-7416 ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict the locale length provided to t…
    PHP
    EPSS 6.7% chance of exploitation in 30 days, percentile 93%
  27. 9.8
    CVE-2016-7414 The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the uncompressed_filesize field is l…
    PHP
    EPSS 6.8% chance of exploitation in 30 days, percentile 94%
  28. 9.8
    CVE-2016-7413 Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote…
    PHP
    EPSS 6.7% chance of exploitation in 30 days, percentile 93%
  29. 8.1
    CVE-2016-7412 ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field has the UNSIGNED_FLAG flag,…
    PHP
    EPSS 8.9% chance of exploitation in 30 days, percentile 95%
  30. 9.8
    CVE-2016-7411 ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows remote attackers to cause a…
    PHP
    EPSS 5.6% chance of exploitation in 30 days, percentile 93%