Overview 1,475 matches · 0 in Waratek scope · 0 protected · 40 exploited · 9 CISA KEV · 49 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
4
0.3%
Not applicable
1,471
99.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
1,475
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
40
2.7%
Working exploit published
1,428
96.8%
Proof of concept only
7
0.5%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 240 / year
19972
Not applicable2
High2
not blocked2
Working exploit published2
19980
19990
20005
Not applicable5
High3
Medium2
not blocked5
Working exploit published5
20017
Not applicable7
High4
Medium3
not blocked7
Working exploit published7
200231
Not applicable31
Critical1
High15
Medium15
not blocked31
Exploited1
Working exploit published30
200326
Not applicable26
High15
Medium10
Low1
not blocked26
Working exploit published26
200467
Not applicable67
Critical1
High29
Medium36
Low1
not blocked67
Exploited1
Working exploit published66
2005117
Not applicable117
High56
Medium61
not blocked117
Exploited1
Working exploit published116
2006240
Not applicable240
High129
Medium100
Low11
not blocked240
Working exploit published240
2007239
Not applicable239
Critical2
High138
Medium98
Low1
not blocked239
Working exploit published239
2008190
Not applicable190
High114
Medium74
Low2
not blocked190
Working exploit published190
2009188
Not applicable188
Critical2
High114
Medium71
Low1
not blocked188
Exploited1
Working exploit published187
201071
Not applicable71
Critical1
High35
Medium35
not blocked71
Working exploit published71
201143
Not applicable43
High18
Medium25
not blocked43
Exploited2
Working exploit published41
201250
Not applicable50
Critical1
High17
Medium30
Low2
not blocked50
Exploited6
Working exploit published44
201317
Outside Waratek scope1
Not applicable16
High9
Medium8
not blocked17
Working exploit published17
201419
Not applicable19
High7
Medium12
not blocked19
Working exploit published19
201514
Outside Waratek scope1
Not applicable13
High6
Medium8
not blocked14
Exploited1
Working exploit published13
201613
Not applicable13
Critical10
High1
Medium2
not blocked13
Exploited2
Working exploit published9
Proof of concept only2
201737
Outside Waratek scope1
Not applicable36
Critical15
High15
Medium7
not blocked37
Exploited2
Working exploit published35
201822
Not applicable22
Critical3
High10
Medium8
Low1
not blocked22
Exploited3
Working exploit published19
201919
Outside Waratek scope1
Not applicable18
Critical9
High4
Medium6
not blocked19
Exploited8
Working exploit published11
202016
Not applicable16
Critical3
High7
Medium6
not blocked16
Exploited2
Working exploit published13
Proof of concept only1
20214
Not applicable4
Medium4
not blocked4
Working exploit published4
202210
Not applicable10
Critical2
High3
Medium5
not blocked10
Exploited2
Working exploit published7
Proof of concept only1
202311
Not applicable11
High1
Medium10
not blocked11
Working exploit published11
20247
Not applicable7
Critical3
High3
Medium1
not blocked7
Exploited2
Working exploit published4
Proof of concept only1
20256
Not applicable6
Critical2
High4
not blocked6
Exploited4
Working exploit published1
Proof of concept only1
20264
Not applicable4
Critical2
High1
Medium1
not blocked4
Exploited2
Working exploit published1
Proof of concept only1
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-109619 | Critical | 2026-10-21 | Not applicable | Exploited | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE). |
| CVE-2026-109618 | Critical | 2026-10-21 | Not applicable | Exploited | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE). |
| CVE-2026-17544 | High | 2026-07-30 | Not applicable | Proof of concept only | Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9. |
| CVE-2026-24421 | Medium | 2026-01-24 | Not applicable | Working exploit published | phpMyFAQ is an open source FAQ web application. Versions 4.0.16 and below have flawed authorization logic which exposes the /api/setup/backup endpoint to any authenticated user despite their permissions. SetupController.php uses userIsAuthenticated() but does not verify that the requester has configuration/admin permissions. Non-admin users can trigger a configuration backup and retrieve its path. The endpoint only checks authentication, not authorization, and returns a link to the generated ZIP. This issue is fixed in version 4.0.17. |
| CVE-2025-69200 | High | 2025-12-29 | Not applicable | Exploited | phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via `POST /api/setup/backup` and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive configuration files (e.g., `database.php` with database credentials), leading to high-impact information disclosure and potential follow-on compromise. Version 4.0.16 fixes the issue. |
| CVE-2025-63888 | Critical | 2025-11-20 | Not applicable | Proof of concept only | The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability. |
| CVE-2025-44137 | High | 2025-07-29 | Not applicable | Exploited | MapTiler Tileserver-php v2.0 is vulnerable to Directory Traversal. The renderTile function within tileserver.php is responsible for delivering tiles that are stored as files on the server via web request. Creating the path to a file allows the insertion of "../" and thus read any file on the web server. Affected GET parameters are "TileMatrix", "TileRow", "TileCol" and "Format" |
| CVE-2025-44136 | Critical | 2025-07-29 | Not applicable | Exploited | MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. This leads to XSS and allows an unauthenticated attacker to execute arbitrary HTML or JavaScript code on a victim's browser. |
| CVE-2025-34045 | High | 2025-06-26 | Not applicable | Exploited | A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co., Ltd. The flaw occurs in the picUrl parameter of the /public/index.php/material/Material/_download_imgage endpoint, where insufficient input validation allows unauthenticated remote attackers to perform directory traversal via crafted POST requests. This enables arbitrary file read on the server, potentially exposing sensitive information such as configuration files and source code. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC. |
| CVE-2025-45542 | High | 2025-06-02 | Not applicable | Working exploit published | SQL injection vulnerability in the registrationform endpoint of CloudClassroom-PHP-Project v1.0. The pass parameter is vulnerable due to improper input validation, allowing attackers to inject SQL queries. |
| CVE-2024-55889 | High | 2024-12-13 | Not applicable | Working exploit published | phpMyFAQ is an open source FAQ web application. Prior to version 3.2.10, a vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an <iframe> element without user interaction or explicit consent. Version 3.2.10 fixes the issue. |
| CVE-2024-45293 | High | 2024-10-07 | Not applicable | Working exploit published | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks in the XLSX reader can be bypassed by slightly modifying the XML structure, utilizing white-spaces. On servers that allow users to upload their own Excel (XLSX) sheets, Server files and sensitive information can be disclosed by providing a crafted sheet. The security scan function in src/PhpSpreadsheet/Reader/Security/XmlScanner.php contains a flawed XML encoding check to retrieve the input file's XML encoding in the toUtf8 function. The function searches for the XML encoding through a defined regex which looks for `encoding="*"` and/or `encoding='*'`, if not found, it defaults to the UTF-8 encoding which bypasses the conversion logic. This logic can be used to pass a UTF-7 encoded XXE payload, by utilizing a whitespace before or after the = in the attribute definition. Sensitive information disclosure through the XXE on sites that allow users to upload their own excel spreadsheets, and parse them using PHPSpreadsheet's Excel parser. This issue has been addressed in release versions 1.29.1, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2024-44902 | Critical | 2024-09-09 | Not applicable | Exploited | A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code. |
| CVE-2024-41358 | Medium | 2024-08-29 | Not applicable | Working exploit published | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via app\admin\import-export\import-load-data.php. |
| CVE-2024-41357 | High | 2024-07-26 | Not applicable | Working exploit published | phpipam 1.6 is vulnerable to Cross Site Scripting (XSS) via /app/admin/powerDNS/record-edit.php. |
| CVE-2024-37051 | Critical | 2024-06-10 | Not applicable | Proof of concept only | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4 |
| CVE-2024-4577 | Critical | 2024-06-09 | Not applicable | Exploited | In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc. |
| CVE-2023-5863 | Medium | 2023-10-31 | Not applicable | Working exploit published | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
| CVE-2023-38875 | Medium | 2023-09-20 | Not applicable | Working exploit published | A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'validator' parameter in '/reset-password'. |
| CVE-2023-41538 | Medium | 2023-08-30 | Not applicable | Working exploit published | phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter. |
| CVE-2023-30212 | Medium | 2023-04-26 | Not applicable | Working exploit published | OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php. |
| CVE-2023-30210 | Medium | 2023-04-26 | Not applicable | Working exploit published | OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php. |
| CVE-2023-1880 | Medium | 2023-04-05 | Not applicable | Working exploit published | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12. |
| CVE-2023-24657 | Medium | 2023-03-08 | Not applicable | Working exploit published | phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php. |
| CVE-2023-1211 | High | 2023-03-07 | Not applicable | Working exploit published | SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2. |
| CVE-2023-0678 | Medium | 2023-02-04 | Not applicable | Working exploit published | Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1. |
| CVE-2023-0676 | Medium | 2023-02-04 | Not applicable | Working exploit published | Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. |
| CVE-2022-46888 | Medium | 2023-01-19 | Not applicable | Working exploit published | Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php. |
| CVE-2021-30134 | Medium | 2022-12-26 | Not applicable | Exploited | php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to post_multidimensional.php. |
| CVE-2022-47945 | Critical | 2022-12-23 | Not applicable | Exploited | ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php. |
| CVE-2022-4407 | Medium | 2022-12-11 | Not applicable | Working exploit published | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
| CVE-2022-3766 | Medium | 2022-10-31 | Not applicable | Working exploit published | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8. |
| CVE-2022-31626 | High | 2022-06-16 | Not applicable | Proof of concept only | In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability. |
| CVE-2022-27308 | Medium | 2022-05-09 | Not applicable | Working exploit published | A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a project title. |
| CVE-2022-23881 | Critical | 2022-03-23 | Not applicable | Working exploit published | ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. |
| CVE-2022-25481 | High | 2022-03-21 | Not applicable | Working exploit published | ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode. |
| CVE-2022-23808 | Medium | 2022-01-22 | Not applicable | Working exploit published | An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection. |
| CVE-2022-23046 | High | 2022-01-19 | Not applicable | Working exploit published | PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php |
| CVE-2021-37704 | Medium | 2021-08-12 | Not applicable | Working exploit published | PhpFastCache is a high-performance backend cache system (packagist package phpfastcache/phpfastcache). In versions before 6.1.5, 7.1.2, and 8.0.7 the `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc). Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5. Older versions such as v5, v4 are not longer supported and will **NOT** be patched. As a workaround, protect the `/vendor` directory from public access. |
| CVE-2021-25791 | Medium | 2021-07-23 | Not applicable | Working exploit published | Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields. |
| CVE-2020-18268 | Medium | 2021-06-07 | Not applicable | Working exploit published | Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." |
| CVE-2020-35687 | Medium | 2021-01-13 | Not applicable | Working exploit published | PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim. |
| CVE-2020-20300 | Critical | 2020-12-18 | Not applicable | Exploited | SQL injection vulnerability in the wp_where function in WeiPHP 5.0. |
| CVE-2020-35416 | Medium | 2020-12-15 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities exist in PHPJabbers Appointment Scheduler 2.3, in the index.php admin login webpage (with different request parameters), allows remote attackers to inject arbitrary web script or HTML. |
| CVE-2020-28688 | High | 2020-11-17 | Not applicable | Working exploit published | The add artwork functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. |
| CVE-2020-28687 | High | 2020-11-17 | Not applicable | Working exploit published | The edit profile functionality in ARTWORKS GALLERY IN PHP, CSS, JAVASCRIPT, AND MYSQL 1.0 allows remote attackers to upload arbitrary files. |
| CVE-2020-26935 | Critical | 2020-10-10 | Not applicable | Working exploit published | An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3. A SQL injection vulnerability was discovered in how phpMyAdmin processes SQL statements in the search feature. An attacker could use this flaw to inject malicious SQL in to a query. |
| CVE-2020-24949 | High | 2020-09-03 | Not applicable | Exploited | Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE). |
| CVE-2020-11579 | High | 2020-09-03 | Not applicable | Proof of concept only | An issue was discovered in Chadha PHPKB 9.0 Enterprise Edition. installer/test-connection.php (part of the installation process) allows a remote unauthenticated attacker to disclose local files on hosts running PHP before 7.2.16, or on hosts where the MySQL ALLOW LOCAL DATA INFILE option is enabled. |
| CVE-2020-12706 | Medium | 2020-05-07 | Not applicable | Working exploit published | Multiple Cross-site scripting vulnerabilities in PHP-Fusion 9.03.50 allow remote attackers to inject arbitrary web script or HTML via the go parameter to faq/faq_admin.php or shoutbox_panel/shoutbox_admin.php |
| CVE-2020-11441 | Medium | 2020-03-31 | Not applicable | Working exploit published | phpMyAdmin 5.0.2 allows CRLF injection, as demonstrated by %0D%0Astring%0D%0A inputs to login form fields causing CRLF sequences to be reflected on an error page. NOTE: the vendor states "I don't see anything specifically exploitable. |
| CVE-2020-10387 | Medium | 2020-03-12 | Not applicable | Working exploit published | Path Traversal in admin/download.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to download files from the server using a dot-dot-slash sequence (../) via the GET parameter file. |
| CVE-2020-10386 | High | 2020-03-12 | Not applicable | Working exploit published | admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by uploading a .php file in the admin/js/ directory. |
| CVE-2011-3336 | High | 2020-02-12 | Not applicable | Working exploit published | regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion. |
| CVE-2020-8547 | Critical | 2020-02-03 | Not applicable | Working exploit published | phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. |
| CVE-2020-8505 | Medium | 2020-01-31 | Not applicable | Working exploit published | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=deleteadmin CSRF to delete a user. |
| CVE-2020-8504 | Medium | 2020-01-31 | Not applicable | Working exploit published | School Management Software PHP/mySQL through 2019-03-14 allows office_admin/?action=addadmin CSRF to add an administrative user. |
| CVE-2020-5504 | High | 2020-01-09 | Not applicable | Working exploit published | In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server. |
| CVE-2019-19908 | Medium | 2019-12-20 | Not applicable | Working exploit published | phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmc_username parameter to pass_reset.php is vulnerable. |
| CVE-2011-1939 | Critical | 2019-11-26 | Not applicable | Working exploit published | SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6. |
| CVE-2019-11043 | Critical | 2019-10-28 | Outside Waratek scope | Exploited | In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. |
| CVE-2019-5129 | Critical | 2019-10-25 | Not applicable | Exploited | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getSpiritsFromVideo.php is vulnerable to a command injection attack. |
| CVE-2019-5128 | Critical | 2019-10-25 | Not applicable | Exploited | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack. |
| CVE-2019-5127 | Critical | 2019-10-25 | Not applicable | Exploited | A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImage.php is vulnerable to a command injection attack. |
| CVE-2019-16693 | Critical | 2019-09-22 | Not applicable | Working exploit published | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used. |
| CVE-2019-16692 | Critical | 2019-09-22 | Not applicable | Working exploit published | phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter-result.php table parameter when action=add is used. |
| CVE-2019-12922 | Medium | 2019-09-13 | Not applicable | Working exploit published | A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page. |
| CVE-2019-14470 | Medium | 2019-09-04 | Not applicable | Working exploit published | cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php error_description parameter. |
| CVE-2019-14430 | Medium | 2019-08-20 | Not applicable | Working exploit published | plugin/Audit/Objects/AuditTable.php in YouPHPTube through 7.2 allows SQL Injection. |
| CVE-2019-12616 | Medium | 2019-06-05 | Not applicable | Working exploit published | An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken <img> tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim. |
| CVE-2019-12099 | High | 2019-05-14 | Not applicable | Working exploit published | In PHP-Fusion 9.03.00, edit_profile.php allows remote authenticated users to execute arbitrary code because includes/dynamics/includes/form_fileinput.php and includes/classes/PHPFusion/Installer/Lib/Core.settings.inc mishandle executable files during avatar upload. |
| CVE-2019-10647 | Critical | 2019-03-30 | Not applicable | Exploited | ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source[] parameter because of a lack of inc/zzz_file.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if the 192.168.0.1 web server sends the contents of a .php file (i.e., it does not interpret a .php file). |
| CVE-2019-9762 | Critical | 2019-03-14 | Not applicable | Exploited | A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any authentication. |
| CVE-2019-9082 | High | 2019-02-24 | Not applicable | Exploited | ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command. |
| CVE-2019-9041 | High | 2019-02-23 | Not applicable | Exploited | An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring. |
| CVE-2019-6977 | High | 2019-01-27 | Not applicable | Working exploit published | gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be exploited by an attacker who is able to trigger imagecolormatch calls with crafted image data. |
| CVE-2019-6799 | Medium | 2019-01-26 | Not applicable | Working exploit published | An issue was discovered in phpMyAdmin before 4.8.5. When the AllowArbitraryServer configuration setting is set to true, with the use of a rogue MySQL server, an attacker can read any file on the server that the web server's user can access. This is related to the mysql.allow_local_infile PHP configuration, and the inadvertent ignoring of "options(MYSQLI_OPT_LOCAL_INFILE" calls. |
| CVE-2018-19518 | High | 2018-11-25 | Not applicable | Exploited | University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection, which might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input (e.g., entered by a user of a web application) and if rsh has been replaced by a program with different argument semantics. For example, if rsh is a link to ssh (as seen on Debian and Ubuntu systems), then the attack can use an IMAP server name containing a "-oProxyCommand" argument. |
| CVE-2018-19458 | High | 2018-11-22 | Not applicable | Working exploit published | In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an index.php?q=file:/// LFI URI, a different vulnerability than CVE-2018-19246. |
| CVE-2018-19277 | High | 2018-11-14 | Not applicable | Working exploit published | securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file |
| CVE-2018-19246 | High | 2018-11-13 | Not applicable | Working exploit published | PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the aeb067ca0aa9a3193dce3a7264c90187 app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion. |
| CVE-2018-19127 | Critical | 2018-11-09 | Not applicable | Exploited | A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename, leading to arbitrary code execution. The PHP code is sent via the template parameter, and is written to a data/cache_template/*.tpl.php file along with a "<?php function " substring. |
| CVE-2018-17082 | Medium | 2018-09-16 | Not applicable | Working exploit published | The Apache2 component in PHP before 5.6.38, 7.0.x before 7.0.32, 7.1.x before 7.1.22, and 7.2.x before 7.2.10 allows XSS via the body of a "Transfer-Encoding: chunked" request, because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c. |
| CVE-2014-6050 | Medium | 2018-08-28 | Not applicable | Working exploit published | phpMyFAQ before 2.8.13 allows remote attackers to bypass the CAPTCHA protection mechanism by replaying the request. |
| CVE-2014-6049 | Low | 2018-08-28 | Not applicable | Working exploit published | phpMyFAQ before 2.8.13 allows remote authenticated users with admin privileges to bypass authorization via a crafted instance ID parameter. |
| CVE-2014-6048 | Medium | 2018-08-28 | Not applicable | Working exploit published | phpMyFAQ before 2.8.13 allows remote attackers to read arbitrary attachments via a direct request. |
| CVE-2014-6047 | Medium | 2018-08-28 | Not applicable | Working exploit published | phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to read arbitrary attachments by leveraging incorrect "download an attachment" permission checks. |
| CVE-2014-6046 | High | 2018-08-28 | Not applicable | Working exploit published | Multiple cross-site request forgery (CSRF) vulnerabilities in phpMyFAQ before 2.8.13 allow remote attackers to hijack the authentication of unspecified users for requests that (1) delete active users by leveraging improper validation of CSRF tokens or that (2) delete open questions, (3) activate users, (4) publish FAQs, (5) add or delete Glossary, (6) add or delete FAQ news, or (7) add or delete comments or add votes by leveraging lack of a CSRF token. |
| CVE-2014-6045 | High | 2018-08-28 | Not applicable | Working exploit published | SQL injection vulnerability in phpMyFAQ before 2.8.13 allows remote authenticated users with certain permissions to execute arbitrary SQL commands via vectors involving the restore function. |
| CVE-2018-14869 | Medium | 2018-08-06 | Not applicable | Working exploit published | PHP Template Store Script 3.0.6 allows XSS via the Address line 1, Address Line 2, Bank name, or A/C Holder name field in a profile. |
| CVE-2018-12613 | High | 2018-06-21 | Not applicable | Exploited | An issue was discovered in phpMyAdmin 4.8.x before 4.8.2, in which an attacker can include (view and potentially execute) files on the server. The vulnerability comes from a portion of code where pages are redirected and loaded within phpMyAdmin, and an improper test for whitelisted pages. An attacker must be authenticated, except in the "$cfg['AllowArbitraryServer'] = true" case (where an attacker can specify any host he/she is already in control of, and execute arbitrary code on phpMyAdmin) and the "$cfg['ServerDefault'] = 0" case (which bypasses the login requirement and runs the vulnerable code without any authentication). |
| CVE-2018-10188 | High | 2018-04-19 | Not applicable | Working exploit published | phpMyAdmin 4.8.0 before 4.8.0-1 has CSRF, allowing an attacker to execute arbitrary SQL statements, related to js/db_operations.js, js/tbl_operations.js, libraries/classes/Operations.php, and sql.php. |
| CVE-2018-9238 | Medium | 2018-04-04 | Not applicable | Working exploit published | proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter. |
| CVE-2018-7737 | Medium | 2018-03-06 | Not applicable | Working exploit published | In Z-BlogPHP 1.5.1.1740, there is Web Site physical path leakage, as demonstrated by admin_footer.php or admin_footer.php. NOTE: the software maintainer disputes that this is a vulnerability |
| CVE-2018-7736 | Medium | 2018-03-06 | Not applicable | Working exploit published | In Z-BlogPHP 1.5.1.1740, cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability |
| CVE-2018-7584 | Critical | 2018-03-01 | Not applicable | Working exploit published | In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c. This subsequently results in copying a large string. |
| CVE-2018-5954 | High | 2018-01-25 | Not applicable | Working exploit published | phpFreeChat 1.7 and earlier allows remote attackers to cause a denial of service by sending a large number of connect commands. |
| CVE-2018-5211 | Critical | 2018-01-09 | Not applicable | Working exploit published | PHP Melody version 2.7.1 suffer from SQL Injection Time-based attack on the page ajax.php with the parameter playlist. |
| CVE-2017-1000499 | High | 2018-01-03 | Not applicable | Working exploit published | phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc. |
| CVE-2017-17874 | High | 2017-12-27 | Not applicable | Working exploit published | Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI. |