Corrigé dans
Vérifiez votre version
php -r 'echo PHP_VERSION;'CVE affectant 7.4
| CVE | Titre | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|
| CVE-2026-109619 | RCE via stale global state | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-109618 | RCE via OOM corruption | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2022-37454 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer ove... | 9.8 | — | 2022-10-21 | |
| CVE-2024-3566 | Command injection vulnerability in programing languages on Microsoft Windows operating system. | 9.8 | — | 2024-04-10 | |
| CVE-2017-9120 | PHP 7.x through 7.1.5 allows remote attackers to cause a denial of service (buffer overflow and application cr... | 9.8 | — | 2018-08-03 | |
| CVE-2017-8923 | The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string... | 9.8 | — | 2017-05-13 | |
| CVE-2021-21708 | UAF due to php_filter_float() failing | 8.2 | — | 2022-02-27 | |
| CVE-2022-31625 | Freeing unallocated memory in php_pgsql_free_params() | 8.1 | — | 2022-06-16 | |
| CVE-2021-21703 | PHP-FPM memory access in root process leading to privilege escalation | 7.8 | — | 2021-10-25 | |
| CVE-2022-31626 | mysqlnd/pdo password buffer overflow | 7.5 | — | 2022-06-16 | |
| CVE-2017-9118 | PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call. | 7.5 | — | 2018-08-03 | |
| CVE-2020-7062 | Null Pointer Dereference in PHP Session Upload Progress | 7.5 | — | 2020-02-28 | |
| CVE-2020-7067 | OOB Read in urldecode() | 7.5 | — | 2020-04-28 | |
| CVE-2020-7065 | mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full | 7.4 | — | 2020-04-01 | |
| CVE-2022-31629 | $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities | 6.5 | — | 2022-09-29 | |
| CVE-2022-31630 | OOB read due to insufficient input validation in imageloadfont() | 6.5 | — | 2022-11-14 | |
| CVE-2019-11049 | mail() may release string with refcount==1 twice | 6.5 | — | 2019-12-23 | |
| CVE-2020-7059 | OOB read in php_strip_tags_ex | 6.5 | — | 2020-02-10 | |
| CVE-2020-7060 | global buffer-overflow in mbfl_filt_conv_big5_wchar | 6.5 | — | 2020-02-10 | |
| CVE-2020-7061 | heap-buffer-overflow in phar_extract_file | 6.5 | — | 2020-02-28 | |
| CVE-2020-7064 | Use-of-uninitialized-value in exif | 6.5 | — | 2020-04-01 | |
| CVE-2022-4900 | Potential buffer overflow in php_cli_server_startup_workers | 6.2 | — | 2023-11-03 | |
| CVE-2020-7063 | Files added to tar with Phar::buildFromIterator have all-access permissions | 5.5 | — | 2020-02-28 | |
| CVE-2020-7069 | Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV | 5.4 | — | 2020-10-02 | |
| CVE-2024-5458 | Filter bypass in filter_var (FILTER_VALIDATE_URL) | 5.3 | — | 2024-06-10 | |
| CVE-2020-7066 | get_headers() silently truncates after a null byte | 5.3 | — | 2020-04-01 | |
| CVE-2019-11048 | Temporary files are not cleaned after OOM when parsing HTTP request data | 5.3 | — | 2020-05-20 | |
| CVE-2020-7071 | FILTER_VALIDATE_URL accepts URLs with invalid userinfo | 5.3 | — | 2021-02-15 | |
| CVE-2021-21702 | Null Dereference in SoapClient | 5.3 | — | 2021-02-15 | |
| CVE-2021-21706 | ZipArchive::extractTo may extract outside of destination dir | 5.3 | — | 2021-10-04 | |
| CVE-2021-21707 | Special characters break path parsing in XML functions | 5.3 | — | 2021-11-29 | |
| CVE-2021-21704 | Multiple vulnerabilities in Firebird client extension | 5.0 | — | 2021-10-04 | |
| CVE-2019-11047 | Heap-buffer-overflow READ in exif | 4.8 | — | 2019-12-23 | |
| CVE-2019-11050 | Use-after-free in exif parsing under memory sanitizer | 4.8 | — | 2019-12-23 | |
| CVE-2020-7068 | Use of freed hash key in the phar_parse_zipfile function | 4.8 | — | 2020-09-10 | |
| CVE-2020-7070 | PHP parses encoded cookie names so malicious `__Host-` cookies can be sent | 4.3 | — | 2020-10-02 | |
| CVE-2021-21705 | Incorrect URL validation in FILTER_VALIDATE_URL | 4.3 | — | 2021-10-04 | |
| CVE-2019-11044 | link() silently truncates after a null byte on Windows | 3.7 | — | 2019-12-23 | |
| CVE-2019-11045 | DirectoryIterator class silently truncates after a null byte | 3.7 | — | 2019-12-23 | |
| CVE-2019-11046 | Buffer underflow in bc_shift_addsub | 3.7 | — | 2019-12-23 | |
| CVE-2022-31628 | phar wrapper can occur dos when using quine gzip file | 2.3 | — | 2022-09-29 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).