Product by PHP Group
PHP
106 known vulnerabilities in PHP (PHP Group), 3 of them actively exploited (CISA KEV).
Key figures
106
Vulnerabilities
3
Actively exploited (KEV)
1
Used by ransomware
27
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-4577 | Argument Injection in PHP-CGI In CISA KEVRansomwarealso in 3 other products | 9.8 | |
| Critical | CVE-2026-109618 | RCE via OOM corruption In CISA KEValso in 12 other products | 9.8 | |
| Critical | CVE-2026-109619 | RCE via stale global state In CISA KEValso in 12 other products | 8.1 | |
| Critical | CVE-2024-1874 | Command injection via array-ish $command parameter of proc_open() | 9.4 | |
| Critical | CVE-2023-3824 | Buffer overflow and overread in phar_dir_read() | 9.4 | |
| High | CVE-2024-5585 | Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix) | 7.7 | |
| High | CVE-2022-31626 | mysqlnd/pdo password buffer overflow | 7.5 | |
| Medium | CVE-2024-2756 | __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix | 6.5 | |
| Medium | CVE-2022-31629 | PHP: Improper Input Validation | 6.5 | |
| High | CVE-2024-8926 | PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) | 8.1 | |
| Critical | CVE-2024-11236 | Integer overflow in the firebird and dblib quoters causing OOB writes | 9.8 | |
| Critical | CVE-2022-31631 | PDO::quote() may return unquoted string | 9.1 | |
| High | CVE-2022-31625 | Freeing unallocated memory in php_pgsql_free_params() | 8.1 | |
| Medium | CVE-2024-5458 | Filter bypass in filter_var (FILTER_VALIDATE_URL) | 5.3 | |
| Critical | CVE-2020-7060 | global buffer-overflow in mbfl_filt_conv_big5_wchar | 6.5 | |
| High | CVE-2020-7065 | mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full | 7.4 | |
| High | CVE-2020-7067 | OOB Read in urldecode() | 7.5 | |
| Critical | CVE-2020-7059 | OOB read in php_strip_tags_ex | 6.5 | |
| Medium | CVE-2021-21707 | Special characters break path parsing in XML functions | 5.3 | |
| Critical | CVE-2021-21708 | UAF due to php_filter_float() failing | 8.2 | |
| High | CVE-2020-7062 | Null Pointer Dereference in PHP Session Upload Progress | 7.5 | |
| Medium | CVE-2020-7064 | Use-of-uninitialized-value in exif | 6.5 | |
| Critical | CVE-2019-11049 | mail() may release string with refcount==1 twice | 6.5 | |
| Critical | CVE-2020-7061 | heap-buffer-overflow in phar_extract_file | 6.5 | |
| Critical | CVE-2024-11235 | Reference counting in php_request_shutdown causes Use-After-Free | 8.1 |
News
- CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Executionthehackernews,
- PHP2Shell security flaws now sucessfully exploited in the wildbleepingcomputer,
- PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activitythehackernews,
- PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malwarethehackernews,
- PHP2Shell exposes the weakness in coordinated vulnerability disclosurecsoonline,
- Neutralizing PHP2Shell: Stopping Critical PHP RCEs with VMware vDefend and Avi WAFvmware-security,