PHP.

RCE via stale global state

• PHP
• Memory corruption
• CWE-755

RCE via OOM corruption

• PHP
• Memory corruption
• CWE-755

OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

• PHP
• Memory corruption

IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

• PHP
• CWE-1023

TLS Hostname Verification Falls Back to CN After SAN Mismatch

• PHP
• Weak cryptography or TLS

Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

• PHP
• Memory corruption

Various packet overreads in mysqlnd_writeprotocol.c

• PHP
• Memory corruption

Cross-origin credential leak in HTTP stream wrapper redirects

• PHP
• Information disclosure
• Hard-coded credentials

SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

• PHP
• Denial of service

Integer overflow to buffer overflow in soap HTTP parsing

• PHP
• Memory corruption

PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

• PHP
• CWE-67

Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

• PHP
• Memory corruption

Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

• PHP
• Memory corruption

Stack overflow in phar with circular symlinks

• PHP
• Memory corruption

Out-of-bounds write in bccomp() via crafted operand and scale

• PHP
• Memory corruption

SQL injection in ext-pgsql via E'...' backslash breakout

• PHP
• SQL injection

ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD

• php
• Memory corruption

DoS attack via DOMNode::C14N()

• PHP
• Denial of service

Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding

• PHP
• Memory corruption

Out-of-bounds read in urldecode() on NetBSD

• PHP
• Memory corruption

Use-After-Free in SOAP using Apache map

• PHP
• Memory corruption

Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

• PHP
• Memory corruption

SoapServer session-persisted object use-after-free via SOAP header fault

• PHP
• Memory corruption

NULL pointer dereference in SOAP apache:Map decoder with missing <value>

• PHP
• Memory corruption

SQL injection in pdo_firebird via NUL bytes in quoted strings

• PHP
• SQL injection

Signed integer overflow in metaphone()

• PHP
• Memory corruption

XSS within PHP-FPM status endpoint

• PHP
• Cross-site scripting (XSS)

Information Leak of Memory in getimagesize

• PHP
• Memory corruption

Heap buffer overflow in array_merge()

• PHP
• Memory corruption

NULL Pointer Dereference in PDO quoting

• PHP
• Memory corruption

pgsql extension does not check for errors during escaping

• PHP
• SQL injection
• Memory corruption

Null byte termination in hostnames

• PHP
• Server-side request forgery (SSRF)

NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

• PHP
• Memory corruption

Reference counting in php_request_shutdown causes Use-After-Free

• PHP
• Memory corruption

Stream HTTP wrapper truncates redirect location to 1024 bytes

• PHP
• Memory corruption

Stream HTTP wrapper header check might omit basic auth header

• PHP
• CWE-20

Streams HTTP wrapper does not fail for headers with invalid name and no colon

• PHP
• CWE-20

libxml streams use wrong content-type header when requesting a redirected resource

• PHP
• CWE-1116

Header parser of http stream wrapper does not handle folded headers

• PHP
• CWE-20

PDO::quote() may return unquoted string

• PHP
• Other injection

Single byte overread with convert.quoted-printable-decode filter

• PHP
• Memory corruption

Configuring a proxy in a stream context might allow for CRLF injection in URIs

• PHP
• CWE-20

Integer overflow in the firebird and dblib quoters causing OOB writes

• PHP
• Memory corruption

Leak partial content of the heap through heap buffer over-read in mysqlnd

• PHP
• Memory corruption
• Information disclosure

OOB access in ldap_escape

• PHP
• Memory corruption

PHP-FPM logs from children may be altered

• PHP
• Other injection
• CWE-158

cgi.force_redirect configuration is bypassable due to the environment variable collision

• PHP
• CWE-1220

PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

• PHP
• Command injection

Erroneous parsing of multipart form data

• PHP
• HTTP request smuggling

PHP is vulnerable to the Marvin Attack

• PHP
• Information disclosure

Argument Injection in PHP-CGI

• PHP
• Command injection

Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

• PHP
• Command injection
• CWE-116

Filter bypass in filter_var (FILTER_VALIDATE_URL)

• PHP
• CWE-345

Command injection via array-ish $command parameter of proc_open()

• PHP
• CWE-116

PHP mb_encode_mimeheader runs endlessly for some inputs

• PHP
• Denial of service

PHP function password_verify can erroneously return true when argument contains NUL

• PHP
• CWE-20

__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix

• PHP
• CWE-20

Potential buffer overflow in php_cli_server_startup_workers

• php
• Red Hat Enterprise Linux 6
• Memory corruption

Buffer overflow and overread in phar_dir_read()

• PHP
• Memory corruption

Security issue with external entity loading in XML without enabling it

• PHP