Corregido en
Comprueba tu versión
php -r 'echo PHP_VERSION;'CVE que afectan a 5.3
| CVE | Título | CVSS | Explotada | EPSS | Publicación |
|---|---|---|---|---|---|
| CVE-2012-1823 | sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi)... | 9.8 | KEV | 100.0% | 2012-05-11 |
| CVE-2012-2376 | Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers... | 10.0 | — | 2012-05-22 | |
| CVE-2012-2688 | Unspecified vulnerability in the _php_stream_scandir function in the stream implementation in PHP before 5.3.1... | 10.0 | — | 2012-07-20 | |
| CVE-2011-3268 | Buffer overflow in the crypt function in PHP before 5.3.7 allows context-dependent attackers to have an unspec... | 10.0 | — | 2011-08-26 | |
| CVE-2024-3566 | Command injection vulnerability in programing languages on Microsoft Windows operating system. | 9.8 | — | 2024-04-10 | |
| CVE-2016-3141 | Use-after-free vulnerability in wddx.c in the WDDX extension in PHP before 5.5.33 and 5.6.x before 5.6.19 allo... | 9.8 | — | 2016-04-01 | |
| CVE-2015-4116 | Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 an... | 9.8 | — | 2016-05-16 | |
| CVE-2015-4599 | The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x befor... | 9.8 | — | 2016-05-16 | |
| CVE-2015-4600 | The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote... | 9.8 | — | 2016-05-16 | |
| CVE-2015-4601 | PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly exe... | 9.8 | — | 2016-05-16 | |
| CVE-2015-4602 | The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.... | 9.8 | — | 2016-05-16 | |
| CVE-2015-4603 | The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24,... | 9.8 | — | 2016-05-16 | |
| CVE-2015-4642 | The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before... | 9.8 | — | 2016-05-16 | |
| CVE-2015-4643 | Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5... | 9.8 | — | 2016-05-16 | |
| CVE-2015-5589 | The phar_convert_to_other function in ext/phar/phar_object.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.... | 9.8 | — | 2016-05-16 | |
| CVE-2015-6834 | Multiple use-after-free vulnerabilities in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 all... | 9.8 | — | 2016-05-16 | |
| CVE-2015-6835 | The session deserializer in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.6.13 mishandles multipl... | 9.8 | — | 2016-05-16 | |
| CVE-2015-8835 | The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.... | 9.8 | — | 2016-05-16 | |
| CVE-2016-2554 | Stack-based buffer overflow in ext/phar/tar.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3... | 9.8 | — | 2016-05-16 | |
| CVE-2016-4537 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 a... | 9.8 | — | 2016-05-22 | |
| CVE-2016-4538 | The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 m... | 9.8 | — | 2016-05-22 | |
| CVE-2016-4539 | The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before... | 9.8 | — | 2016-05-22 | |
| CVE-2016-4540 | The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21... | 9.8 | — | 2016-05-22 | |
| CVE-2016-4541 | The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21,... | 9.8 | — | 2016-05-22 | |
| CVE-2016-4542 | The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before... | 9.8 | — | 2016-05-22 | |
| CVE-2016-4543 | The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x be... | 9.8 | — | 2016-05-22 | |
| CVE-2016-6288 | The php_url_parse_ex function in ext/standard/url.c in PHP before 5.5.38 allows remote attackers to cause a de... | 9.8 | — | 2016-07-25 | |
| CVE-2016-6290 | ext/session/session.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly mainta... | 9.8 | — | 2016-07-25 | |
| CVE-2016-6291 | The exif_process_IFD_in_MAKERNOTE function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7... | 9.8 | — | 2016-07-25 | |
| CVE-2016-6294 | The locale_accept_from_http function in ext/intl/locale/locale_methods.c in PHP before 5.5.38, 5.6.x before 5.... | 9.8 | — | 2016-07-25 | |
| CVE-2016-6295 | ext/snmp/snmp.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 improperly interacts with the... | 9.8 | — | 2016-07-25 | |
| CVE-2016-6296 | Integer signedness error in the simplestring_addn function in simplestring.c in xmlrpc-epi through 0.54.2, as... | 9.8 | — | 2016-07-25 | |
| CVE-2016-5768 | Double free vulnerability in the _php_mb_regex_ereg_replace_exec function in php_mbregex.c in the mbstring ext... | 9.8 | — | 2016-08-07 | |
| CVE-2016-5769 | Multiple integer overflows in mcrypt.c in the mcrypt extension in PHP before 5.5.37, 5.6.x before 5.6.23, and... | 9.8 | — | 2016-08-07 | |
| CVE-2016-5770 | Integer overflow in the SplFileObject::fread function in spl_directory.c in the SPL extension in PHP before 5.... | 9.8 | — | 2016-08-07 | |
| CVE-2016-5771 | spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the un... | 9.8 | — | 2016-08-07 | |
| CVE-2016-5772 | Double free vulnerability in the php_wddx_process_data function in wddx.c in the WDDX extension in PHP before... | 9.8 | — | 2016-08-07 | |
| CVE-2016-5773 | php_zip.c in the zip extension in PHP before 5.5.37, 5.6.x before 5.6.23, and 7.x before 7.0.8 improperly inte... | 9.8 | — | 2016-08-07 | |
| CVE-2016-7124 | ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles certain invalid objects,... | 9.8 | — | 2016-09-12 | |
| CVE-2016-7126 | The imagetruecolortopalette function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not proper... | 9.8 | — | 2016-09-12 | |
| CVE-2016-7127 | The imagegammacorrect function in ext/gd/gd.c in PHP before 5.6.25 and 7.x before 7.0.10 does not properly val... | 9.8 | — | 2016-09-12 | |
| CVE-2016-7129 | The php_wddx_process_data function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote... | 9.8 | — | 2016-09-12 | |
| CVE-2016-7411 | ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles object-deserialization failures, which allows... | 9.8 | — | 2016-09-18 | |
| CVE-2016-7413 | Use-after-free vulnerability in the wddx_stack_destroy function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.... | 9.8 | — | 2016-09-18 | |
| CVE-2016-7414 | The ZIP signature-verification feature in PHP before 5.6.26 and 7.x before 7.0.11 does not ensure that the unc... | 9.8 | — | 2016-09-18 | |
| CVE-2018-7584 | In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-ba... | 9.8 | — | 2018-03-02 | |
| CVE-2016-7417 | ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 proceeds with SplArray unserialization without... | 9.8 | — | 2016-09-18 | |
| CVE-2014-9912 | The get_icu_disp_value_src_php function in ext/intl/locale/locale_methods.c in PHP before 5.3.29, 5.4.x before... | 9.8 | — | 2017-01-05 | |
| CVE-2016-9137 | Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl_file.c in PHP before 5.6.27 and 7... | 9.8 | — | 2017-01-05 | |
| CVE-2016-9138 | PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, which a... | 9.8 | — | 2017-01-05 | |
| CVE-2016-9935 | The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote... | 9.8 | — | 2017-01-05 | |
| CVE-2010-1866 | The dechunk filter in PHP 5.3 through 5.3.2, when decoding an HTTP chunked encoding stream, allows context-dep... | 9.8 | — | 2010-05-08 | |
| CVE-2019-9020 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.... | 9.8 | — | 2019-02-23 | |
| CVE-2019-9021 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.... | 9.8 | — | 2019-02-23 | |
| CVE-2019-9023 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.... | 9.8 | — | 2019-02-23 | |
| CVE-2017-8923 | The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string... | 9.8 | — | 2017-05-13 | |
| CVE-2017-9224 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | 9.8 | — | 2017-05-25 | |
| CVE-2017-9225 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | 9.8 | — | 2017-05-25 | |
| CVE-2019-9641 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.... | 9.8 | — | 2019-03-09 | |
| CVE-2017-9226 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | 9.8 | — | 2017-05-25 | |
| CVE-2011-1939 | SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASC... | 9.8 | — | 2019-11-27 | |
| CVE-2017-12933 | The finish_nested_data function in ext/standard/var_unserializer.re in PHP before 5.6.31, 7.0.x before 7.0.21,... | 9.8 | — | 2017-08-18 | |
| CVE-2007-1581 | The resource system in PHP 5.0.0 through 5.2.1 allows context-dependent attackers to execute arbitrary code by... | 9.3 | — | 2007-03-22 | |
| CVE-2009-3546 | The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before 5.3.1, and the GD Graphics Library 2.x, do... | 9.3 | — | 2009-10-20 | |
| CVE-2016-1903 | The gdImageRotateInterpolated function in ext/gd/libgd/gd_interpolation.c in PHP before 5.5.31, 5.6.x before 5... | 9.1 | — | 2016-01-19 | |
| CVE-2016-5114 | sapi/fpm/fpm/fpm_log.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the seman... | 9.1 | — | 2016-08-07 | |
| CVE-2017-11147 | In PHP before 5.6.30 and 7.x before 7.0.15, the PHAR archive handler could be used by attackers supplying mali... | 9.1 | — | 2017-07-10 | |
| CVE-2016-4342 | ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length... | 8.8 | — | 2016-05-22 | |
| CVE-2016-4343 | The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles... | 8.8 | — | 2016-05-22 | |
| CVE-2016-6297 | Integer overflow in the php_stream_zip_opener function in ext/zip/zip_stream.c in PHP before 5.5.38, 5.6.x bef... | 8.8 | — | 2016-07-25 | |
| CVE-2018-10549 | An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5... | 8.8 | — | 2018-04-30 | |
| CVE-2018-19520 | An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a check_bad f... | 8.8 | — | 2018-11-26 | |
| CVE-2019-6977 | gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolorm... | 8.8 | — | 2019-01-27 | |
| CVE-2016-5093 | The get_icu_value_internal function in ext/intl/locale/locale_methods.c in PHP before 5.5.36, 5.6.x before 5.6... | 8.6 | — | 2016-08-07 | |
| CVE-2016-5094 | Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x befor... | 8.6 | — | 2016-08-07 | |
| CVE-2016-5095 | Integer overflow in the php_escape_html_entities_ex function in ext/standard/html.c in PHP before 5.5.36 and 5... | 8.6 | — | 2016-08-07 | |
| CVE-2016-5096 | Integer overflow in the fread function in ext/standard/file.c in PHP before 5.5.36 and 5.6.x before 5.6.22 all... | 8.6 | — | 2016-08-07 | |
| CVE-2016-3142 | The phar_parse_zipfile function in zip.c in the PHAR extension in PHP before 5.5.33 and 5.6.x before 5.6.19 al... | 8.2 | — | 2016-04-01 | |
| CVE-2016-6174 | applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invisio... | 8.1 | — | 2016-07-13 | |
| CVE-2016-7412 | ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before 7.0.11 does not verify that a BIT field... | 8.1 | — | 2016-09-18 | |
| CVE-2016-6289 | Integer overflow in the virtual_file_ex function in TSRM/tsrm_virtual_cwd.c in PHP before 5.5.38, 5.6.x before... | 7.8 | — | 2016-07-25 | |
| CVE-2016-5399 | The bzread function in ext/bz2/bz2.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 allows re... | 7.8 | — | 2017-04-22 | |
| CVE-2017-11628 | In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, a stack-based buffer overflow in the zend_ini... | 7.8 | — | 2017-07-26 | |
| CVE-2011-3379 | The is_a function in PHP 5.3.7 and 5.3.8 triggers a call to the __autoload function, which makes it easier for... | 7.5 | — | 2011-11-04 | |
| CVE-2012-0830 | The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbit... | 7.5 | — | 2012-02-07 | |
| CVE-2012-2311 | sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi)... | 7.5 | — | 2012-05-11 | |
| CVE-2012-2335 | php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a pr... | 7.5 | — | 2012-05-11 | |
| CVE-2012-2386 | Integer overflow in the phar_parse_tarfile function in tar.c in the phar extension in PHP before 5.3.14 and 5.... | 7.5 | — | 2012-07-07 | |
| CVE-2013-1635 | ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the so... | 7.5 | — | 2013-03-06 | |
| CVE-2014-9653 | readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, an... | 7.5 | — | 2015-03-30 | |
| CVE-2014-9705 | Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before... | 7.5 | — | 2015-03-30 | |
| CVE-2013-3735 | The Zend Engine in PHP before 5.4.16 RC1, and 5.5.0 before RC2, does not properly determine whether a parser e... | 7.5 | — | 2013-06-01 | |
| CVE-2015-0273 | Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and... | 7.5 | — | 2015-03-30 | |
| CVE-2015-1351 | Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extensi... | 7.5 | — | 2015-03-30 | |
| CVE-2015-2331 | Integer overflow in the _zip_cdir_new function in zip_dirent.c in libzip 0.11.2 and earlier, as used in the ZI... | 7.5 | — | 2015-03-30 | |
| CVE-2015-2787 | Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP be... | 7.5 | — | 2015-03-30 | |
| CVE-2013-6420 | The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x... | 7.5 | — | 2013-12-17 | |
| CVE-2015-3307 | The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x befor... | 7.5 | — | 2015-06-10 | |
| CVE-2015-3329 | Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40,... | 7.5 | — | 2015-06-10 | |
| CVE-2015-4022 | Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5... | 7.5 | — | 2015-06-10 | |
| CVE-2015-4025 | PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 c... | 7.5 | — | 2015-06-10 | |
| CVE-2015-4026 | The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pa... | 7.5 | — | 2015-06-10 | |
| CVE-2015-4147 | The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5... | 7.5 | — | 2015-06-10 | |
| CVE-2014-3515 | The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.14 incorrectly anticipates that certain data struc... | 7.5 | — | 2014-07-09 | |
| CVE-2015-6833 | Directory traversal vulnerability in the PharData class in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x b... | 7.5 | — | 2016-01-19 | |
| CVE-2014-3669 | Integer overflow in the object_custom function in ext/standard/var_unserializer.c in PHP before 5.4.34, 5.5.x... | 7.5 | — | 2014-10-29 | |
| CVE-2014-8142 | Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP be... | 7.5 | — | 2014-12-20 | |
| CVE-2014-9425 | Double free vulnerability in the zend_ts_hash_graceful_destroy function in zend_ts_hash.c in the Zend Engine i... | 7.5 | — | 2014-12-31 | |
| CVE-2014-9427 | sapi/cgi/cgi_main.c in the CGI component in PHP through 5.4.36, 5.5.x through 5.5.20, and 5.6.x through 5.6.4,... | 7.5 | — | 2015-01-03 | |
| CVE-2015-0231 | Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP be... | 7.5 | — | 2015-01-27 | |
| CVE-2014-0236 | file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a de... | 7.5 | — | 2016-05-16 | |
| CVE-2015-4604 | The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x be... | 7.5 | — | 2016-05-16 | |
| CVE-2015-4605 | The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x b... | 7.5 | — | 2016-05-16 | |
| CVE-2015-4644 | The php_pgsql_meta_data function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP before 5.4.42, 5.5.... | 7.5 | — | 2016-05-16 | |
| CVE-2015-6837 | The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.... | 7.5 | — | 2016-05-16 | |
| CVE-2015-6838 | The xsl_ext_function_php function in ext/xsl/xsltprocessor.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.... | 7.5 | — | 2016-05-16 | |
| CVE-2015-8873 | Stack consumption vulnerability in Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x... | 7.5 | — | 2016-05-16 | |
| CVE-2015-8874 | Stack consumption vulnerability in GD in PHP before 5.6.12 allows remote attackers to cause a denial of servic... | 7.5 | — | 2016-05-16 | |
| CVE-2016-4070 | Integer overflow in the php_raw_url_encode function in ext/standard/url.c in PHP before 5.5.34, 5.6.x before 5... | 7.5 | — | 2016-05-20 | |
| CVE-2015-8877 | The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as... | 7.5 | — | 2016-05-22 | |
| CVE-2015-8879 | The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVAR... | 7.5 | — | 2016-05-22 | |
| CVE-2016-7125 | ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that tri... | 7.5 | — | 2016-09-12 | |
| CVE-2016-7130 | The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote... | 7.5 | — | 2016-09-12 | |
| CVE-2016-7131 | ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of servic... | 7.5 | — | 2016-09-12 | |
| CVE-2016-7132 | ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows remote attackers to cause a denial of servic... | 7.5 | — | 2016-09-12 | |
| CVE-2017-16642 | In PHP before 5.6.32, 7.x before 7.0.25, and 7.1.x before 7.1.11, an error in the date extension's timelib_mer... | 7.5 | — | 2017-11-08 | |
| CVE-2016-10712 | In PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3, all of the return values of stream_get_meta_d... | 7.5 | — | 2018-02-09 | |
| CVE-2016-7416 | ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x before 7.0.11 does not properly restrict th... | 7.5 | — | 2016-09-18 | |
| CVE-2018-10546 | An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5... | 7.5 | — | 2018-04-30 | |
| CVE-2016-7418 | The php_wddx_push_element function in ext/wddx/wddx.c in PHP before 5.6.26 and 7.x before 7.0.11 allows remote... | 7.5 | — | 2016-09-18 | |
| CVE-2018-10548 | An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5... | 7.5 | — | 2018-04-30 | |
| CVE-2009-3559 | main/streams/plain_wrapper.c in PHP 5.3.x before 5.3.1 does not recognize the safe_mode_include_dir directive,... | 7.5 | — | 2009-11-23 | |
| CVE-2009-4018 | The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforc... | 7.5 | — | 2009-11-28 | |
| CVE-2016-9934 | ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of servic... | 7.5 | — | 2017-01-05 | |
| CVE-2018-14883 | An issue was discovered in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8... | 7.5 | — | 2018-08-03 | |
| CVE-2018-15132 | An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7... | 7.5 | — | 2018-08-08 | |
| CVE-2016-7478 | Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to ca... | 7.5 | — | 2017-01-11 | |
| CVE-2018-19395 | ext/standard/var.c in PHP 5.x through 7.1.24 on Windows allows attackers to cause a denial of service (NULL po... | 7.5 | — | 2018-11-21 | |
| CVE-2018-19396 | ext/standard/var_unserializer.c in PHP 5.x through 7.1.24 allows attackers to cause a denial of service (appli... | 7.5 | — | 2018-11-21 | |
| CVE-2016-10158 | The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x b... | 7.5 | — | 2017-01-25 | |
| CVE-2016-10159 | Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before... | 7.5 | — | 2017-01-25 | |
| CVE-2010-1868 | The (1) sqlite_single_query and (2) sqlite_array_query functions in ext/sqlite/sqlite.c in PHP 5.2 through 5.2... | 7.5 | — | 2010-05-08 | |
| CVE-2016-10161 | The object_common1 function in ext/standard/var_unserializer.c in PHP before 5.6.30, 7.0.x before 7.0.15, and... | 7.5 | — | 2017-01-25 | |
| CVE-2018-20783 | In PHP before 5.6.39, 7.x before 7.0.33, 7.1.x before 7.1.25, and 7.2.x before 7.2.13, a buffer over-read in P... | 7.5 | — | 2019-02-22 | |
| CVE-2015-8994 | An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with... | 7.5 | — | 2017-03-02 | |
| CVE-2017-7963 | The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause... | 7.5 | — | 2017-04-20 | |
| CVE-2019-9024 | An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1.... | 7.5 | — | 2019-02-23 | |
| CVE-2019-9637 | An issue was discovered in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.3. Due to the way rena... | 7.5 | — | 2019-03-09 | |
| CVE-2019-9638 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.... | 7.5 | — | 2019-03-09 | |
| CVE-2019-9639 | An issue was discovered in the EXIF component in PHP before 7.1.27, 7.2.x before 7.2.16, and 7.3.x before 7.3.... | 7.5 | — | 2019-03-09 | |
| CVE-2010-2225 | Use-after-free vulnerability in the SplObjectStorage unserializer in PHP 5.2.x and 5.3.x through 5.3.2 allows... | 7.5 | — | 2010-06-24 | |
| CVE-2017-9229 | An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP... | 7.5 | — | 2017-05-25 | |
| CVE-2016-10397 | In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser cou... | 7.5 | — | 2017-07-10 | |
| CVE-2017-11142 | In PHP before 5.6.31, 7.x before 7.0.17, and 7.1.x before 7.1.3, remote attackers could cause a CPU consumptio... | 7.5 | — | 2017-07-10 | |
| CVE-2017-11143 | In PHP before 5.6.31, an invalid free in the WDDX deserialization of boolean parameters could be used by attac... | 7.5 | — | 2017-07-10 | |
| CVE-2017-11144 | In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, the openssl extension PEM sealing code did no... | 7.5 | — | 2017-07-10 | |
| CVE-2017-11145 | In PHP before 5.6.31, 7.x before 7.0.21, and 7.1.x before 7.1.7, an error in the date extension's timelib_meri... | 7.5 | — | 2017-07-10 | |
| CVE-2010-4657 | PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then mis... | 7.5 | — | 2019-11-14 | |
| CVE-2011-3336 | regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. | 7.5 | — | 2020-02-13 | |
| CVE-2011-1092 | Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial... | 7.5 | — | 2011-03-16 | |
| CVE-2011-1153 | Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow c... | 7.5 | — | 2011-03-17 | |
| CVE-2011-1148 | Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent... | 7.5 | — | 2011-03-19 | |
| CVE-2011-1938 | Stack-based buffer overflow in the socket_connect function in ext/sockets/sockets.c in PHP 5.3.3 through 5.3.6... | 7.5 | — | 2011-06-01 | |
| CVE-2017-7272 | PHP through 7.1.11 enables potential SSRF in applications that accept an fsockopen or pfsockopen hostname argu... | 7.4 | — | 2017-03-28 | |
| CVE-2015-5590 | Stack-based buffer overflow in the phar_fix_filepath function in ext/phar/phar.c in PHP before 5.4.43, 5.5.x b... | 7.3 | — | 2016-01-19 | |
| CVE-2015-6831 | Multiple use-after-free vulnerabilities in SPL in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6... | 7.3 | — | 2016-01-19 | |
| CVE-2015-6832 | Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44... | 7.3 | — | 2016-01-19 | |
| CVE-2015-6836 | The SoapClient __call method in ext/soap/soap.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x before 5.... | 7.3 | — | 2016-01-19 | |
| CVE-2014-9426 | The apprentice_load function in libmagic/apprentice.c in the Fileinfo component in PHP through 5.6.4 attempts... | 7.3 | — | 2014-12-31 | |
| CVE-2015-8865 | The file_check_mem function in funcs.c in file before 5.23, as used in the Fileinfo component in PHP before 5.... | 7.3 | — | 2016-05-20 | |
| CVE-2014-0185 | sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses... | 7.2 | — | 2014-05-06 | |
| CVE-2016-3185 | The make_http_soap_request function in ext/soap/php_http.c in PHP before 5.4.44, 5.5.x before 5.5.28, 5.6.x be... | 7.1 | — | 2016-05-16 | |
| CVE-2017-9067 | In MODX Revolution before 2.5.7, when PHP 5.3.3 is used, an attacker is able to include and execute arbitrary... | 7.0 | — | 2017-05-19 | |
| CVE-2012-0831 | PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the im... | 6.8 | — | 2012-02-11 | |
| CVE-2013-4113 | ext/xml/xml.c in PHP before 5.3.27 does not properly consider parsing depth, which allows remote attackers to... | 6.8 | — | 2013-07-13 | |
| CVE-2011-4718 | Session fixation vulnerability in the Sessions subsystem in PHP before 5.5.2 allows remote attackers to hijack... | 6.8 | — | 2013-08-13 | |
| CVE-2013-7327 | The gdImageCrop function in ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check return values, which allows r... | 6.8 | — | 2014-02-18 | |
| CVE-2015-3330 | The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and... | 6.8 | — | 2015-06-10 | |
| CVE-2015-7803 | The phar_get_entry_data function in ext/phar/util.c in PHP before 5.5.30 and 5.6.x before 5.6.14 allows remote... | 6.8 | — | 2015-12-11 | |
| CVE-2015-7804 | Off-by-one error in the phar_parse_zipfile function in ext/phar/zip.c in PHP before 5.5.30 and 5.6.x before 5.... | 6.8 | — | 2015-12-11 | |
| CVE-2014-3597 | Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 and 5.5.x bef... | 6.8 | — | 2014-08-23 | |
| CVE-2014-3670 | The exif_ifd_make_value function in exif.c in the EXIF extension in PHP before 5.4.34, 5.5.x before 5.5.18, an... | 6.8 | — | 2014-10-29 | |
| CVE-2015-0232 | The exif_process_unicode function in ext/exif/exif.c in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x befo... | 6.8 | — | 2015-01-27 | |
| CVE-2009-3558 | The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-depe... | 6.8 | — | 2009-11-24 | |
| CVE-2010-2094 | Multiple format string vulnerabilities in the phar extension in PHP 5.3 before 5.3.2 allow context-dependent a... | 6.8 | — | 2010-05-28 | |
| CVE-2010-3064 | Stack-based buffer overflow in the php_mysqlnd_auth_write function in the Mysqlnd extension in PHP 5.3 through... | 6.8 | — | 2010-08-21 | |
| CVE-2010-2950 | Format string vulnerability in stream.c in the phar extension in PHP 5.3.x through 5.3.3 allows context-depend... | 6.8 | — | 2010-09-29 | |
| CVE-2010-3870 | The utf8_decode function in PHP before 5.3.4 does not properly handle non-shortest form UTF-8 encoding and ill... | 6.8 | — | 2010-11-13 | |
| CVE-2010-4697 | Use-after-free vulnerability in the Zend engine in PHP before 5.2.15 and 5.3.x before 5.3.4 might allow contex... | 6.8 | — | 2011-01-19 | |
| CVE-2010-4700 | The set_magic_quotes_runtime function in PHP 5.3.2 and 5.3.3, when the MySQLi extension is used, does not prop... | 6.8 | — | 2011-01-19 | |
| CVE-2022-31629 | $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities | 6.5 | — | 2022-09-29 | |
| CVE-2014-0207 | The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP befo... | 6.5 | — | 2014-07-09 | |
| CVE-2014-3478 | Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component... | 6.5 | — | 2014-07-09 | |
| CVE-2014-3480 | The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4... | 6.5 | — | 2014-07-09 | |
| CVE-2015-3411 | PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequenc... | 6.5 | — | 2016-05-16 | |
| CVE-2015-4598 | PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequen... | 6.5 | — | 2016-05-16 | |
| CVE-2016-6292 | The exif_process_user_comment function in ext/exif/exif.c in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x b... | 6.5 | — | 2016-07-25 | |
| CVE-2015-9253 | An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm ma... | 6.5 | — | 2018-02-20 | |
| CVE-2017-7890 | The GIF decoding function gdImageCreateFromGifCtx in gd_gif_in.c in the GD Graphics Library (aka libgd), as us... | 6.5 | — | 2017-08-03 | |
| CVE-2011-4566 | Integer overflow in the exif_process_IFD_TAG function in exif.c in the exif extension in PHP 5.4.0beta2 on 32-... | 6.4 | — | 2011-11-29 | |
| CVE-2012-0057 | PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary fil... | 6.4 | — | 2012-02-02 | |
| CVE-2009-2626 | The zend_restore_ini_entry_cb function in zend_ini.c in PHP 5.3.0, 5.2.10, and earlier versions allows context... | 6.4 | — | 2009-12-02 | |
| CVE-2010-1861 | The sysvshm extension for PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to w... | 6.4 | — | 2010-05-08 | |
| CVE-2010-2191 | The (1) parse_str, (2) preg_match, (3) unpack, and (4) pack functions; the (5) ZEND_FETCH_RW, (6) ZEND_CONCAT,... | 6.4 | — | 2010-06-08 | |
| CVE-2011-2202 | The rfc1867_post_handler function in main/rfc1867.c in PHP before 5.3.7 does not properly restrict filenames i... | 6.4 | — | 2011-06-17 | |
| CVE-2011-0441 | The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via... | 6.3 | — | 2011-03-30 | |
| CVE-2022-4900 | Potential buffer overflow in php_cli_server_startup_workers | 6.2 | — | 2023-11-03 | |
| CVE-2015-8935 | The sapi_header_op function in main/SAPI.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 s... | 6.1 | — | 2016-08-07 | |
| CVE-2018-5712 | An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1... | 6.1 | — | 2018-01-16 | |
| CVE-2018-10547 | An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.... | 6.1 | — | 2018-04-30 | |
| CVE-2018-17082 | The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10... | 6.1 | — | 2018-09-17 | |
| CVE-2012-5381 | Untrusted search path vulnerability in the installation functionality in PHP 5.3.17, when installed in the top... | 6.0 | — | 2012-10-11 | |
| CVE-2015-8838 | ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL opt... | 5.9 | — | 2016-05-16 | |
| CVE-2012-1172 | The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open squar... | 5.8 | — | 2012-05-24 | |
| CVE-2015-2783 | ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to o... | 5.8 | — | 2015-06-10 | |
| CVE-2018-5711 | gd_gif_in.c in the GD Graphics Library (aka libgd), as used in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x b... | 5.5 | — | 2018-01-16 | |
| CVE-2018-14851 | exif_process_IFD_in_MAKERNOTE in ext/exif/exif.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.2... | 5.5 | — | 2018-08-03 | |
| CVE-2015-3412 | PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequenc... | 5.3 | — | 2016-05-16 | |
| CVE-2016-7128 | The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before 5.6.25 and 7.x before 7.0.10 mishandles... | 5.3 | — | 2016-09-12 | |
| CVE-2014-4049 | Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier all... | 5.1 | — | 2014-06-19 | |
| CVE-2011-4885 | PHP before 5.3.9 computes hash values for form parameters without restricting the ability to trigger hash coll... | 5.0 | — | 2011-12-30 | |
| CVE-2011-4153 | PHP 5.3.8 does not always check the return value of the zend_strndup function, which might allow remote attack... | 5.0 | — | 2012-01-19 | |
| CVE-2012-0781 | The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointe... | 5.0 | — | 2012-01-19 | |
| CVE-2012-0788 | The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allow... | 5.0 | — | 2012-02-15 | |
| CVE-2012-0789 | Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of ser... | 5.0 | — | 2012-02-15 | |
| CVE-2012-2336 | sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi)... | 5.0 | — | 2012-05-11 | |
| CVE-2012-3365 | The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection me... | 5.0 | — | 2012-07-20 | |
| CVE-2012-6113 | The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certai... | 5.0 | — | 2013-01-20 | |
| CVE-2013-1643 | The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files v... | 5.0 | — | 2013-03-06 | |
| CVE-2013-2110 | Heap-based buffer overflow in the php_quot_print_encode function in ext/standard/quot_print.c in PHP before 5.... | 5.0 | — | 2013-06-22 | |
| CVE-2013-4635 | Integer overflow in the SdnToJewish function in jewish.c in the Calendar component in PHP before 5.3.26 and 5.... | 5.0 | — | 2013-06-22 | |
| CVE-2015-1352 | The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not... | 5.0 | — | 2015-03-30 | |
| CVE-2015-2348 | The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5... | 5.0 | — | 2015-03-30 | |
| CVE-2013-6712 | The scan function in ext/date/lib/parse_iso_intervals.c in PHP through 5.5.6 does not properly restrict creati... | 5.0 | — | 2013-11-28 | |
| CVE-2012-1171 | The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechani... | 5.0 | — | 2014-02-15 | |
| CVE-2014-2020 | ext/gd/gd.c in PHP 5.5.x before 5.5.9 does not check data types, which might allow remote attackers to obtain... | 5.0 | — | 2014-02-18 | |
| CVE-2015-4021 | The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before... | 5.0 | — | 2015-06-10 | |
| CVE-2015-4024 | Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before... | 5.0 | — | 2015-06-10 | |
| CVE-2014-0237 | The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before... | 5.0 | — | 2014-06-01 | |
| CVE-2014-0238 | The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5... | 5.0 | — | 2014-06-01 | |
| CVE-2015-4148 | The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7... | 5.0 | — | 2015-06-10 | |
| CVE-2014-3668 | Buffer overflow in the date_from_ISO8601 function in the mkgmtime implementation in libxmlrpc/xmlrpc.c in the... | 5.0 | — | 2014-10-29 | |
| CVE-2014-9652 | The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.... | 5.0 | — | 2015-03-30 | |
| CVE-2009-3294 | The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and 5.3.x before 5.3.1, when running on certa... | 5.0 | — | 2009-09-22 | |
| CVE-2009-3557 | The tempnam function in ext/standard/file.c in PHP before 5.2.12 and 5.3.x before 5.3.1 allows context-depende... | 5.0 | — | 2009-11-24 | |
| CVE-2009-4017 | PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling... | 5.0 | — | 2009-11-24 | |
| CVE-2009-4418 | The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of serv... | 5.0 | — | 2009-12-25 | |
| CVE-2010-0397 | The xmlrpc extension in PHP 5.3.1 does not properly handle a missing methodName element in the first argument... | 5.0 | — | 2010-03-17 | |
| CVE-2010-1130 | session.c in the session extension in PHP before 5.2.13, and 5.3.1, does not properly interpret ; (semicolon)... | 5.0 | — | 2010-03-27 | |
| CVE-2010-1860 | The html_entity_decode function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attac... | 5.0 | — | 2010-05-08 | |
| CVE-2010-1862 | The chunk_split function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to... | 5.0 | — | 2010-05-08 | |
| CVE-2010-1864 | The addcslashes function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to... | 5.0 | — | 2010-05-08 | |
| CVE-2010-1914 | The Zend Engine in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to obtain s... | 5.0 | — | 2010-05-12 | |
| CVE-2010-1915 | The preg_quote function in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attackers to... | 5.0 | — | 2010-05-12 | |
| CVE-2010-1917 | Stack consumption vulnerability in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 allows context-dependent attac... | 5.0 | — | 2010-05-12 | |
| CVE-2010-2093 | Use-after-free vulnerability in the request shutdown functionality in PHP 5.2 before 5.2.13 and 5.3 before 5.3... | 5.0 | — | 2010-05-28 | |
| CVE-2010-2097 | The (1) iconv_mime_decode, (2) iconv_substr, and (3) iconv_mime_encode functions in PHP 5.2 through 5.2.13 and... | 5.0 | — | 2010-05-28 | |
| CVE-2010-2100 | The (1) htmlentities, (2) htmlspecialchars, (3) str_getcsv, (4) http_build_query, (5) strpbrk, and (6) strtr f... | 5.0 | — | 2010-05-28 | |
| CVE-2010-2101 | The (1) strip_tags, (2) setcookie, (3) strtok, (4) wordwrap, (5) str_word_count, and (6) str_pad functions in... | 5.0 | — | 2010-05-28 | |
| CVE-2010-2190 | The (1) trim, (2) ltrim, (3) rtrim, and (4) substr_replace functions in PHP 5.2 through 5.2.13 and 5.3 through... | 5.0 | — | 2010-06-08 | |
| CVE-2010-3062 | mysqlnd_wireprotocol.c in the Mysqlnd extension in PHP 5.3 through 5.3.2 allows remote attackers to (1) read s... | 5.0 | — | 2010-08-21 | |
| CVE-2010-3063 | The php_mysqlnd_read_error_from_line function in the Mysqlnd extension in PHP 5.3 through 5.3.2 does not prope... | 5.0 | — | 2010-08-21 | |
| CVE-2010-3065 | The default session serializer in PHP 5.2 through 5.2.13 and 5.3 through 5.3.2 does not properly handle the PS... | 5.0 | — | 2010-08-21 | |
| CVE-2010-3436 | fopen_wrappers.c in PHP 5.3.x through 5.3.3 might allow remote attackers to bypass open_basedir restrictions v... | 5.0 | — | 2010-11-09 | |
| CVE-2010-4409 | Integer overflow in the NumberFormatter::getSymbol (aka numfmt_get_symbol) function in PHP 5.3.3 and earlier a... | 5.0 | — | 2010-12-07 | |
| CVE-2010-4150 | Double free vulnerability in the imap_do_open function in the IMAP extension (ext/imap/php_imap.c) in PHP 5.2... | 5.0 | — | 2010-12-08 | |
| CVE-2010-4645 | strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 and 5.3 before 5.3.5, and other product... | 5.0 | — | 2011-01-11 | |
| CVE-2006-7243 | PHP before 5.3.4 accepts the \0 character in a pathname, which might allow context-dependent attackers to bypa... | 5.0 | — | 2011-01-19 | |
| CVE-2010-4698 | Stack-based buffer overflow in the GD extension in PHP before 5.2.15 and 5.3.x before 5.3.4 allows context-dep... | 5.0 | — | 2011-01-19 | |
| CVE-2010-4699 | The iconv_mime_decode_headers function in the Iconv extension in PHP before 5.3.4 does not properly handle enc... | 5.0 | — | 2011-01-19 | |
| CVE-2011-0755 | Integer overflow in the mt_rand function in PHP before 5.3.4 might make it easier for context-dependent attack... | 5.0 | — | 2011-02-03 | |
| CVE-2011-0420 | The grapheme_extract function in the Internationalization extension (Intl) for ICU for PHP 5.3.5 allows contex... | 5.0 | — | 2011-02-19 | |
| CVE-2011-1466 | Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-depe... | 5.0 | — | 2011-03-20 | |
| CVE-2011-1467 | Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmt_set_symbol) function in the Intl exten... | 5.0 | — | 2011-03-20 | |
| CVE-2011-1657 | The (1) ZipArchive::addGlob and (2) ZipArchive::addPattern functions in ext/zip/php_zip.c in PHP 5.3.6 allow c... | 5.0 | — | 2011-08-25 | |
| CVE-2011-2483 | crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and othe... | 5.0 | — | 2011-08-25 | |
| CVE-2011-3182 | PHP before 5.3.7 does not properly check the return values of the malloc, calloc, and realloc library function... | 5.0 | — | 2011-08-25 | |
| CVE-2011-3267 | PHP before 5.3.7 does not properly implement the error_log function, which allows context-dependent attackers... | 5.0 | — | 2011-08-26 | |
| CVE-2018-10545 | An issue was discovered in PHP before 5.6.35, 7.0.x before 7.0.29, 7.1.x before 7.1.16, and 7.2.x before 7.2.4... | 4.7 | — | 2018-04-30 | |
| CVE-2014-4670 | Use-after-free vulnerability in ext/spl/spl_dllist.c in the SPL component in PHP through 5.5.14 allows context... | 4.6 | — | 2014-07-10 | |
| CVE-2013-6501 | The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5... | 4.6 | — | 2015-03-30 | |
| CVE-2011-0754 | The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows d... | 4.4 | — | 2011-02-03 | |
| CVE-2012-2143 | The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and... | 4.3 | — | 2012-07-05 | |
| CVE-2011-1398 | The sapi_header_op function in main/SAPI.c in PHP before 5.3.11 and 5.4.x before 5.4.0RC2 does not check for %... | 4.3 | — | 2012-08-31 | |
| CVE-2012-4388 | The sapi_header_op function in main/SAPI.c in PHP 5.4.0RC2 through 5.4.0 does not properly determine a pointer... | 4.3 | — | 2012-09-08 | |
| CVE-2013-4248 | The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2... | 4.3 | — | 2013-08-18 | |
| CVE-2013-1824 | The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files v... | 4.3 | — | 2013-09-16 | |
| CVE-2014-2270 | softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (... | 4.3 | — | 2014-03-15 | |
| CVE-2010-2531 | The var_export function in PHP 5.2 before 5.2.14 and 5.3 before 5.3.3 flushes the output buffer to the user wh... | 4.3 | — | 2010-08-21 | |
| CVE-2010-3710 | Stack consumption vulnerability in the filter_var function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3... | 4.3 | — | 2010-10-26 | |
| CVE-2010-3709 | The ZipArchive::getArchiveComment function in PHP 5.2.x through 5.2.14 and 5.3.x through 5.3.3 allows context-... | 4.3 | — | 2010-11-09 | |
| CVE-2011-0753 | Race condition in the PCNTL extension in PHP before 5.3.4, when a user-defined signal handler exists, might al... | 4.3 | — | 2011-02-03 | |
| CVE-2011-0421 | The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly... | 4.3 | — | 2011-03-20 | |
| CVE-2011-0708 | exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows... | 4.3 | — | 2011-03-20 | |
| CVE-2011-1464 | Buffer overflow in the strval function in PHP before 5.3.6, when the precision configuration option has a larg... | 4.3 | — | 2011-03-20 | |
| CVE-2011-1468 | Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a den... | 4.3 | — | 2011-03-20 | |
| CVE-2011-1469 | Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to c... | 4.3 | — | 2011-03-20 | |
| CVE-2011-1470 | The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (applica... | 4.3 | — | 2011-03-20 | |
| CVE-2011-1471 | Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent att... | 4.3 | — | 2011-03-20 | |
| CVE-2011-3189 | The crypt function in PHP 5.3.7, when the MD5 hash type is used, returns the value of the salt argument instea... | 4.3 | — | 2011-08-25 |
Controla estas versiones en tus propios servidores
InfraGuard recopila las versiones de software instaladas en cada servidor y señala las que tienen vulnerabilidades conocidas. Autoalojado: nada sale de tu red.
Datos: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (consulta EPSS en https://www.first.org/epss), endoflife.date. Lista de software: awesome-selfhosted (CC BY-SA 3.0).