Exposure of PHP

Programming languages
1,137
exposure score
4,221,648
sites use
4
exploited
55
critical

CVEs

1,223 results
CVE-2016-9484—PHP FormMail Generator generates PHP code for standard web forms, and the code generated does not properly validate user input folder directories and is vulnerable to path traversalEPSS 4.4%CVE-2019-11038LOWUninitialized read in gdImageCreateFromXbmEPSS 4.3%CVE-2020-7067HIGHOOB Read in urldecode()EPSS 4.3%CVE-2020-7064MEDIUMUse-of-uninitialized-value in exifEPSS 4.3%CVE-2019-11049MEDIUMmail() may release string with refcount==1 twiceEPSS 4.2%CVE-2019-11046LOWBuffer underflow in bc_shift_addsubEPSS 4.1%CVE-2019-11034MEDIUMHeap over-read in PHP EXIF extensionEPSS 4.1%CVE-2020-7061MEDIUMheap-buffer-overflow in phar_extract_fileEPSS 4.1%CVE-2019-11040MEDIUMHeap buffer overflow in EXIF extensionEPSS 4.1%CVE-2026-48611CRITICALImproper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to uEPSS 3.9%CVE-2011-1939—SQL injection vulnerability in Zend Framework 1.10.x before 1.10.9 and 1.11.x before 1.11.6 when using non-ASCII-compatible encodings in conEPSS 3.9%CVE-2022-31625HIGHFreeing unallocated memory in php_pgsql_free_params()EPSS 3.8%CVE-2013-4454—WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass VulnerabilitiesEPSS 3.7%CVE-2024-8926HIGHPHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)EPSS 3.7%CVE-2020-7062HIGHNull Pointer Dereference in PHP Session Upload ProgressEPSS 3.6%CVE-2021-32708CRITICALTime-of-check Time-of-use (TOCTOU) Race Condition in league/flysystemEPSS 3.5%CVE-2016-9483—PHP FormMail Generator generates PHP code for standard web forms, and the code generated is vulnerable to unsafe deserialization of untrusted dataEPSS 3.4%CVE-2016-9492—PHP forms generated using the PHP FormMail Generator are vulnerable to unrestricted upload of dangerous file typesEPSS 3.3%CVE-2022-39261HIGHTwig may load a template outside a configured directory when using the filesystem loaderEPSS 3.2%CVE-2021-21702MEDIUMNull Dereference in SoapClientEPSS 3.2%