Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.0An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file.May 12, 2026
- Medium6.3docuFORM Managed Print Service Client 11.11c is vulnerable to arbitrary file upload via pmupdate.php.May 11, 2026
- Medium5.1ATutor is vulnerable to Reflected XSS in /install/install.php endpoint.May 11, 2026
- Medium5.1ATutor is vulnerable to Reflected XSS in /install/upgrade.php endpoint.May 11, 2026
- Medium6.3In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data str…May 10, 2026
- Medium6.3In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstrin…May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a sign…May 10, 2026
- Low2.9In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding proces…May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the…May 10, 2026
- Low2.1In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to…May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype…May 10, 2026
- High7.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to co…May 10, 2026
- Critical9.5In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores point…May 10, 2026
- High7.4In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when prepar…May 10, 2026
- Critical9.4phpVMS is a PHP application to run and simulate an airline.May 9, 2026
- High7.6ipl/web is a set of common web components for php projects.May 8, 2026
- Medium5.3novaGallery is a php image gallery.May 8, 2026
- High7.8PHPUnit is a testing framework for PHP.May 8, 2026
- Critical9.8Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint.May 8, 2026
- Critical9.9Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.May 8, 2026
- Critical9.1Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property.May 8, 2026
- Medium5.4SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.May 8, 2026
- Medium6.3SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].May 8, 2026
- High7.3Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page.May 8, 2026
- High7.1FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.May 7, 2026