Filtered by vendor Php Subscriptions
Total 769 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2001-1385 3 Mandrakesoft, Php, Redhat 3 Mandrake Linux, Php, Linux 2025-04-03 N/A
The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
CVE-2006-2419 1 Php 1 Directory Listing Script 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in index.php in Directory Listing Script allows remote attackers to inject arbitrary web script or HTML via the dir parameter.
CVE-2005-3391 1 Php 1 Php 2025-04-03 N/A
Multiple vulnerabilities in PHP before 4.4.1 allow remote attackers to bypass safe_mode and open_basedir restrictions via unknown attack vectors in (1) ext/curl and (2) ext/gd.
CVE-2005-3883 2 Php, Redhat 2 Php, Enterprise Linux 2025-04-03 N/A
CRLF injection vulnerability in the mb_send_mail function in PHP before 5.1.0 might allow remote attackers to inject arbitrary e-mail headers via line feeds (LF) in the "To" address argument.
CVE-1999-0238 1 Php 1 Php 2025-04-03 N/A
php.cgi allows attackers to read any file on the system.
CVE-2002-0081 2 Php, Redhat 3 Php, Linux, Stronghold 2025-04-03 N/A
Buffer overflows in (1) php_mime_split in PHP 4.1.0, 4.1.1, and 4.0.6 and earlier, and (2) php3_mime_split in PHP 3.0.x allows remote attackers to execute arbitrary code via a multipart/form-data HTTP POST request when file_uploads is enabled.
CVE-2003-0442 2 Php, Redhat 2 Php, Linux 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remote attackers to insert arbitrary script via the PHPSESSID parameter.
CVE-2006-1017 1 Php 1 Php 2025-04-03 N/A
The c-client library 2000, 2001, or 2004 for PHP before 4.4.4 and 5.x before 5.1.5 do not check the (1) safe_mode or (2) open_basedir functions, and when used in applications that accept user-controlled input for the mailbox argument to the imap_open function, allow remote attackers to obtain access to an IMAP stream data structure and conduct unauthorized IMAP actions.
CVE-2006-1991 1 Php 1 Php 2025-04-03 N/A
The substr_compare function in string.c in PHP 5.1.2 allows context-dependent attackers to cause a denial of service (memory access violation) via an out-of-bounds offset argument.
CVE-2006-3017 2 Php, Redhat 3 Php, Enterprise Linux, Rhel Stronghold 2025-04-03 N/A
zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.3 and 5.x before 5.1.3 can cause zend_hash_del to delete the wrong element, which prevents a variable from being unset even when the PHP unset function is called, which might cause the variable's value to be used in security-relevant operations.
CVE-2006-4020 2 Php, Redhat 4 Php, Enterprise Linux, Rhel Application Stack and 1 more 2025-04-03 N/A
scanf.c in PHP 5.1.4 and earlier, and 4.4.3 and earlier, allows context-dependent attackers to execute arbitrary code via a sscanf PHP function call that performs argument swapping, which increments an index past the end of an array and triggers a buffer over-read.
CVE-1999-0068 1 Php 1 Php 2025-04-03 N/A
CGI PHP mylog script allows an attacker to read any file on the target server.
CVE-2002-0484 1 Php 1 Php 2025-04-03 N/A
move_uploaded_file in PHP does not does not check for the base directory (open_basedir), which could allow remote attackers to upload files to unintended locations on the system.
CVE-2006-3011 1 Php 1 Php 2025-04-03 N/A
The error_log function in basic_functions.c in PHP before 4.4.4 and 5.x before 5.1.5 allows local users to bypass safe mode and open_basedir restrictions via a "php://" or other scheme in the third argument, which disables safe mode.
CVE-2006-4625 1 Php 1 Php 2025-04-03 N/A
PHP 4.x up to 4.4.4 and PHP 5 up to 5.1.6 allows local users to bypass certain Apache HTTP Server httpd.conf options, such as safe_mode and open_basedir, via the ini_restore function, which resets the values to their php.ini (Master Value) defaults.
CVE-2006-0097 1 Php 1 Php 2025-04-03 N/A
Stack-based buffer overflow in the create_named_pipe function in libmysql.c in PHP 4.3.10 and 4.4.x before 4.4.3 for Windows allows attackers to execute arbitrary code via a long (1) arg_host or (2) arg_unix_socket argument, as demonstrated by a long named pipe variable in the host argument to the mysql_connect function.
CVE-2006-0144 2 Apache2triad, Php 2 Apache2triad, Pear 2025-04-03 N/A
The proxy server feature in go-pear.php in PHP PEAR 0.2.2, as used in Apache2Triad, allows remote attackers to execute arbitrary PHP code by redirecting go-pear.php to a malicious proxy server that provides a modified version of Tar.php with a malicious extractModify function.
CVE-2000-0860 1 Php 1 Php 2025-04-03 N/A
The file upload capability in PHP versions 3 and 4 allows remote attackers to read arbitrary files by setting hidden form fields whose names match the names of internal PHP script variables.
CVE-2004-1065 5 Openpkg, Php, Redhat and 2 more 5 Openpkg, Php, Enterprise Linux and 2 more 2025-04-03 N/A
Buffer overflow in the exif_read_data function in PHP before 4.3.10 and PHP 5.x up to 5.0.2 allows remote attackers to execute arbitrary code via a long section name in an image file.
CVE-2006-4486 2 Php, Redhat 3 Php, Enterprise Linux, Rhel Application Stack 2025-04-03 N/A
Integer overflow in memory allocation routines in PHP before 5.1.6, when running on a 64-bit system, allows context-dependent attackers to bypass the memory_limit restriction.