[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fS3wbcF9ragcjEEgo7rj80Jf4i_Ymm7AFIijfuJ8nvfQ":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":154,"kevVulnerabilities":217,"topProductsByCves":242,"seoMetadata":253,"meta":262},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":153},24265,"php",34,756,5,933,"2025-07-13","p",[16,21,27,34,38,42,47,51,56,60,65,69,72,75,79,84,89,93,97,102,106,110,114,118,121,126,129,132,135,138,141,144,147,150],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":20,"last_cve_update":13},128135,606,725,3,{"id":22,"product_name":23,"version_count":24,"cve_count":11,"kev_count":25,"last_cve_update":26},128129,"pear",84,0,"2017-02-01",{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":32,"last_cve_update":33},128110,"archive_tar",19,4,2,"2021-07-30",{"id":35,"product_name":36,"version_count":25,"cve_count":32,"kev_count":25,"last_cve_update":37},128131,"pearweb","2022-04-15",{"id":39,"product_name":40,"version_count":25,"cve_count":32,"kev_count":25,"last_cve_update":41},128139,"php_script_index","2006-03-31",{"id":43,"product_name":44,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":46},128117,"directory_listing_script",1,"2006-05-16",{"id":48,"product_name":49,"version_count":45,"cve_count":45,"kev_count":25,"last_cve_update":50},128120,"errordocs","2006-12-14",{"id":52,"product_name":53,"version_count":54,"cve_count":45,"kev_count":25,"last_cve_update":55},128121,"ext-http",98,"2019-09-06",{"id":57,"product_name":58,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":59},128122,"f1_maxs_file_uploader","2008-01-22",{"id":61,"product_name":62,"version_count":63,"cve_count":45,"kev_count":25,"last_cve_update":64},128142,"xml_rpc",25,"2005-07-05",{"id":66,"product_name":67,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":68},128111,"ar_memberscript","2006-12-15",{"id":70,"product_name":71,"version_count":45,"cve_count":45,"kev_count":25,"last_cve_update":50},128112,"blog_cms",{"id":73,"product_name":74,"version_count":45,"cve_count":45,"kev_count":25,"last_cve_update":68},128113,"bloq",{"id":76,"product_name":77,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":78},128114,"com_extensions","2007-03-10",{"id":80,"product_name":81,"version_count":82,"cve_count":45,"kev_count":25,"last_cve_update":83},128125,"imagick",6,"2019-05-03",{"id":85,"product_name":86,"version_count":87,"cve_count":45,"kev_count":25,"last_cve_update":88},128126,"memcached",13,"2022-04-05",{"id":90,"product_name":91,"version_count":45,"cve_count":45,"kev_count":25,"last_cve_update":92},128127,"mysql_banner_exchange","2007-12-21",{"id":94,"product_name":95,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":96},128128,"mysql_extension","2007-09-14",{"id":98,"product_name":99,"version_count":100,"cve_count":45,"kev_count":25,"last_cve_update":101},128130,"pear_archive_tar",29,"2018-12-28",{"id":103,"product_name":104,"version_count":45,"cve_count":45,"kev_count":25,"last_cve_update":105},128132,"pecl_http","2017-01-23",{"id":107,"product_name":108,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":109},128138,"php_fi","1997-10-16",{"id":111,"product_name":112,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":113},128140,"phpsquidpass","2002-12-31",{"id":115,"product_name":116,"version_count":11,"cve_count":45,"kev_count":25,"last_cve_update":117},128141,"xhprof","2014-03-11",{"id":119,"product_name":120,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":50},128109,"animated_smiley_generator",{"id":122,"product_name":123,"version_count":124,"cve_count":25,"kev_count":25,"last_cve_update":125},128123,"frankenphp",41,null,{"id":127,"product_name":128,"version_count":25,"cve_count":25,"kev_count":25,"last_cve_update":125},128124,"go-pear.php",{"id":130,"product_name":131,"version_count":25,"cve_count":25,"kev_count":25,"last_cve_update":125},128133,"pecl_phpdoc",{"id":133,"product_name":134,"version_count":45,"cve_count":25,"kev_count":25,"last_cve_update":125},128134,"phorum",{"id":136,"product_name":137,"version_count":25,"cve_count":25,"kev_count":25,"last_cve_update":125},128116,"cvs",{"id":139,"product_name":140,"version_count":25,"cve_count":25,"kev_count":25,"last_cve_update":125},128136,"php123_top_sites",{"id":142,"product_name":143,"version_count":25,"cve_count":25,"kev_count":25,"last_cve_update":125},128119,"easymoblog",{"id":145,"product_name":146,"version_count":25,"cve_count":25,"kev_count":25,"last_cve_update":125},128137,"phpbookingcalendar",{"id":148,"product_name":149,"version_count":25,"cve_count":25,"kev_count":25,"last_cve_update":125},128118,"dirlist",{"id":151,"product_name":152,"version_count":45,"cve_count":25,"kev_count":25,"last_cve_update":125},128115,"comoblog","Php is a technology vendor with 34 tracked products and 756 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[155,163,168,175,182,189,195,201,207,213],{"cveId":156,"description":157,"publishedDate":158,"cvssScore":159,"cvssVersion":160,"severity":161,"isKev":4,"epssScore":162},"CVE-2012-1823","sapi\u002Fcgi\u002Fcgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.","2012-05-11",9.8,"v3.1","Critical",0.99998,{"cveId":164,"description":165,"publishedDate":166,"cvssScore":159,"cvssVersion":160,"severity":161,"isKev":4,"epssScore":167},"CVE-2024-4577","In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.","2024-06-09",0.99987,{"cveId":169,"description":170,"publishedDate":171,"cvssScore":172,"cvssVersion":160,"severity":173,"isKev":4,"epssScore":174},"CVE-2019-11043","In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.","2019-10-28",8.7,"High",0.9947,{"cveId":176,"description":177,"publishedDate":178,"cvssScore":179,"cvssVersion":160,"severity":173,"isKev":180,"epssScore":181},"CVE-2018-19518","University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client\u002Fimap4r1.c and the tcp_aopen function in osdep\u002Funix\u002Ftcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a \"-oProxyCommand\" argument.","2018-11-25",7.5,false,0.9523,{"cveId":183,"description":184,"publishedDate":185,"cvssScore":186,"cvssVersion":187,"severity":161,"isKev":180,"epssScore":188},"CVE-2015-0235","Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka \"GHOST.\"","2015-01-28",10,"v2",0.94859,{"cveId":190,"description":191,"publishedDate":192,"cvssScore":159,"cvssVersion":193,"severity":161,"isKev":180,"epssScore":194},"CVE-2018-7584","In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext\u002Fstandard\u002Fhttp_fopen_wrapper.c. This subsequently results in copying a large string.","2018-03-01","v3.0",0.87883,{"cveId":196,"description":197,"publishedDate":198,"cvssScore":199,"cvssVersion":160,"severity":173,"isKev":4,"epssScore":200},"CVE-2020-28949","Archive_Tar through 1.4.10 has :\u002F\u002F filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:\u002F\u002F to overwrite files) can still succeed.","2020-11-19",7.8,0.84554,{"cveId":202,"description":203,"publishedDate":204,"cvssScore":11,"cvssVersion":187,"severity":205,"isKev":180,"epssScore":206},"CVE-2011-4885","PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","2011-12-30","Medium",0.83911,{"cveId":208,"description":209,"publishedDate":210,"cvssScore":211,"cvssVersion":193,"severity":205,"isKev":180,"epssScore":212},"CVE-2018-5712","An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.","2018-01-16",6.1,0.79949,{"cveId":214,"description":215,"publishedDate":64,"cvssScore":179,"cvssVersion":187,"severity":173,"isKev":180,"epssScore":216},"CVE-2005-1921","Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.",0.79071,[218,223,228,235,239],{"cveId":164,"description":165,"publishedDate":166,"cvssScore":159,"cvssVersion":160,"severity":161,"isKev":4,"epssScore":167,"cisaVulnName":219,"cisaDateAdded":220,"cisaShortDescription":221,"cisaRequiredAction":222},"PHP-CGI OS Command Injection Vulnerability","2024-06-12","PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.","Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",{"cveId":196,"description":197,"publishedDate":198,"cvssScore":199,"cvssVersion":160,"severity":173,"isKev":4,"epssScore":200,"cisaVulnName":224,"cisaDateAdded":225,"cisaShortDescription":226,"cisaRequiredAction":227},"PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability","2022-08-25","PEAR Archive_Tar allows an unserialization attack because phar: is blocked but PHAR: is not blocked. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.","Apply updates per vendor instructions.",{"cveId":229,"description":230,"publishedDate":231,"cvssScore":179,"cvssVersion":160,"severity":173,"isKev":4,"epssScore":232,"cisaVulnName":233,"cisaDateAdded":225,"cisaShortDescription":234,"cisaRequiredAction":227},"CVE-2020-36193","Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.","2021-01-18",0.70595,"PEAR Archive_Tar Improper Link Resolution Vulnerability","PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.",{"cveId":156,"description":157,"publishedDate":158,"cvssScore":159,"cvssVersion":160,"severity":161,"isKev":4,"epssScore":162,"cisaVulnName":236,"cisaDateAdded":237,"cisaShortDescription":238,"cisaRequiredAction":227},"PHP-CGI Query String Parameter Vulnerability","2022-03-25","sapi\u002Fcgi\u002Fcgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code.",{"cveId":169,"description":170,"publishedDate":171,"cvssScore":172,"cvssVersion":160,"severity":173,"isKev":4,"epssScore":174,"cisaVulnName":240,"cisaDateAdded":237,"cisaShortDescription":241,"cisaRequiredAction":227},"PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability","In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.",[243,244,245,246,247,248,249,250,251,252],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":20,"last_cve_update":13},{"id":22,"product_name":23,"version_count":24,"cve_count":11,"kev_count":25,"last_cve_update":26},{"id":28,"product_name":29,"version_count":30,"cve_count":31,"kev_count":32,"last_cve_update":33},{"id":35,"product_name":36,"version_count":25,"cve_count":32,"kev_count":25,"last_cve_update":37},{"id":39,"product_name":40,"version_count":25,"cve_count":32,"kev_count":25,"last_cve_update":41},{"id":43,"product_name":44,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":46},{"id":48,"product_name":49,"version_count":45,"cve_count":45,"kev_count":25,"last_cve_update":50},{"id":52,"product_name":53,"version_count":54,"cve_count":45,"kev_count":25,"last_cve_update":55},{"id":57,"product_name":58,"version_count":25,"cve_count":45,"kev_count":25,"last_cve_update":59},{"id":61,"product_name":62,"version_count":63,"cve_count":45,"kev_count":25,"last_cve_update":64},{"title":254,"metaDescription":255,"keywords":256,"structuredData":257},"Php - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Php covering 34 products with 756 tracked vulnerabilities including 2 critical and 3 high-severity issues and 5 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Php vulnerabilities, Php security, Php CVE, Php threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Php KEV, Php exploited vulnerabilities",{"@context":258,"@type":259,"name":260,"description":255,"url":261},"https:\u002F\u002Fschema.org","Organization","Php","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fphp",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":263,"apiVersion":264},"2026-10-28T13:57:58.549Z","3.0"]