Filtered by vendor Php Subscriptions
Total 750 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2015-2325 5 Mariadb, Opensuse, Pcre and 2 more 5 Mariadb, Opensuse, Pcre and 2 more 2024-11-21 7.8 High
The compile_branch function in PCRE before 8.37 allows context-dependent attackers to compile incorrect code, cause a denial of service (out-of-bounds heap read and crash), or possibly have other unspecified impact via a regular expression with a group containing a forward reference repeated a large number of times within a repeated outer group that has a zero minimum quantifier.
CVE-2014-3622 1 Php 1 Php 2024-11-21 9.8 Critical
Use-after-free vulnerability in the add_post_var function in the Posthandler component in PHP 5.6.x before 5.6.1 might allow remote attackers to execute arbitrary code by leveraging a third-party filter extension that accesses a certain ksep value.
CVE-2011-3336 4 Apple, Freebsd, Openbsd and 1 more 4 Mac Os X, Freebsd, Openbsd and 1 more 2024-11-21 7.5 High
regcomp in the BSD implementation of libc is vulnerable to denial of service due to stack exhaustion.
CVE-2011-1939 3 Debian, Php, Zend 3 Debian Linux, Php, Zend Framework 2024-11-21 9.8 Critical
SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conjunction PDO_MySql in PHP before 5.3.6.
CVE-2010-4657 3 Debian, Php, Redhat 3 Debian Linux, Php, Enterprise Linux 2024-11-21 7.5 High
PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.
CVE-2024-48581 1 Php 1 Best Courier Management System 2024-10-28 9.8 Critical
File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_class.php component.
CVE-2024-48579 1 Php 1 Best House Rental Management System 2024-10-28 9.8 Critical
SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username parameter of the login request.
CVE-2024-48580 1 Php 1 Best Courier Management System 2024-10-28 9.8 Critical
SQL Injection vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the email parameter of the login request.
CVE-2024-8926 2 Php, Php-fpm 2 Php, Php-fpm 2024-10-16 8.1 High
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVE-2024-9026 3 Php, Php-fpm, Redhat 3 Php, Php-fpm, Enterprise Linux 2024-10-16 3.3 Low
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.