Corrigé dans
Vérifiez votre version
php -r 'echo PHP_VERSION;'CVE affectant 8.1
| CVE | Titre | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|
| CVE-2024-4577 | Argument Injection in PHP-CGI | 9.8 | KEV | 100.0% | 2024-06-10 |
| CVE-2026-109619 | RCE via stale global state | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-109618 | RCE via OOM corruption | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2022-37454 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer ove... | 9.8 | — | 2022-10-21 | |
| CVE-2024-3566 | Command injection vulnerability in programing languages on Microsoft Windows operating system. | 9.8 | — | 2024-04-10 | |
| CVE-2024-8932 | OOB access in ldap_escape | 9.8 | — | 2024-11-22 | |
| CVE-2024-11236 | Integer overflow in the firebird and dblib quoters causing OOB writes | 9.8 | — | 2024-11-24 | |
| CVE-2023-3824 | Buffer overflow and overread in phar_dir_read() | 9.4 | — | 2023-08-11 | |
| CVE-2024-1874 | Command injection via array-ish $command parameter of proc_open() | 9.4 | — | 2024-04-29 | |
| CVE-2022-31631 | PDO::quote() may return unquoted string | 9.1 | — | 2025-02-13 | |
| CVE-2023-3823 | Security issue with external entity loading in XML without enabling it | 8.6 | — | 2023-08-11 | |
| CVE-2021-21708 | UAF due to php_filter_float() failing | 8.2 | — | 2022-02-27 | |
| CVE-2025-14180 | NULL Pointer Dereference in PDO quoting | 8.2 | — | 2025-12-28 | |
| CVE-2022-31625 | Freeing unallocated memory in php_pgsql_free_params() | 8.1 | — | 2022-06-16 | |
| CVE-2024-8926 | PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) | 8.1 | — | 2024-10-08 | |
| CVE-2022-31627 | Heap buffer overflow in finfo_buffer | 7.7 | — | 2022-07-28 | |
| CVE-2023-0567 | password_verify() always returns true for some invalid hashes | 7.7 | — | 2023-02-16 | |
| CVE-2024-5585 | Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix) | 7.7 | — | 2024-06-10 | |
| CVE-2022-31626 | mysqlnd/pdo password buffer overflow | 7.5 | — | 2022-06-16 | |
| CVE-2023-0568 | Array overrun in common path resolve code | 7.5 | — | 2023-02-16 | |
| CVE-2023-0662 | DoS vulnerability when parsing multipart request body | 7.5 | — | 2023-02-16 | |
| CVE-2024-8927 | cgi.force_redirect configuration is bypassable due to the environment variable collision | 7.5 | — | 2024-10-08 | |
| CVE-2017-9118 | PHP 7.1.5 has an Out of bounds access in php_pcre_replace_impl via a crafted preg_replace call. | 7.5 | — | 2018-08-03 | |
| CVE-2022-31629 | $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities | 6.5 | — | 2022-09-29 | |
| CVE-2022-31630 | OOB read due to insufficient input validation in imageloadfont() | 6.5 | — | 2022-11-14 | |
| CVE-2024-3096 | PHP function password_verify can erroneously return true when argument contains NUL | 6.5 | — | 2024-04-29 | |
| CVE-2025-14178 | Heap buffer overflow in array_merge() | 6.5 | — | 2025-12-28 | |
| CVE-2025-1217 | Header parser of http stream wrapper does not handle folded headers | 6.3 | — | 2025-03-29 | |
| CVE-2025-1219 | libxml streams use wrong content-type header when requesting a redirected resource | 6.3 | — | 2025-03-30 | |
| CVE-2025-1734 | Streams HTTP wrapper does not fail for headers with invalid name and no colon | 6.3 | — | 2025-03-30 | |
| CVE-2025-1736 | Stream HTTP wrapper header check might omit basic auth header | 6.3 | — | 2025-03-30 | |
| CVE-2025-1861 | Stream HTTP wrapper truncates redirect location to 1024 bytes | 6.3 | — | 2025-03-30 | |
| CVE-2025-14177 | Information Leak of Memory in getimagesize | 6.3 | — | 2025-12-28 | |
| CVE-2024-2408 | PHP is vulnerable to the Marvin Attack | 5.9 | — | 2024-06-10 | |
| CVE-2025-6491 | NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix | 5.9 | — | 2025-07-14 | |
| CVE-2025-1735 | pgsql extension does not check for errors during escaping | 5.9 | — | 2025-07-14 | |
| CVE-2024-8929 | Leak partial content of the heap through heap buffer over-read in mysqlnd | 5.8 | — | 2024-11-22 | |
| CVE-2024-5458 | Filter bypass in filter_var (FILTER_VALIDATE_URL) | 5.3 | — | 2024-06-10 | |
| CVE-2024-11234 | Configuring a proxy in a stream context might allow for CRLF injection in URIs | 4.8 | — | 2024-11-24 | |
| CVE-2024-11233 | Single byte overread with convert.quoted-printable-decode filter | 4.8 | — | 2024-11-24 | |
| CVE-2025-1220 | Null byte termination in hostnames | 3.7 | — | 2025-07-14 | |
| CVE-2024-9026 | PHP-FPM logs from children may be altered | 3.3 | — | 2024-10-08 | |
| CVE-2024-8925 | Erroneous parsing of multipart form data | 3.1 | — | 2024-10-08 | |
| CVE-2023-3247 | Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP | 2.6 | — | 2023-07-22 | |
| CVE-2022-31628 | phar wrapper can occur dos when using quine gzip file | 2.3 | — | 2022-09-29 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Données : CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (voir EPSS sur https://www.first.org/epss), endoflife.date. Liste des logiciels : awesome-selfhosted (CC BY-SA 3.0).