Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.3In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstrin…May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a sign…May 10, 2026
- Low2.9In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding proces…May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the…May 10, 2026
- Low2.1In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to…May 10, 2026
- Medium6.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype…May 10, 2026
- High7.3In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to co…May 10, 2026
- Critical9.5In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores point…May 10, 2026
- High7.4In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when prepar…May 10, 2026
- Critical9.4phpVMS is a PHP application to run and simulate an airline.May 9, 2026
- High7.6ipl/web is a set of common web components for php projects.May 8, 2026
- Medium5.3novaGallery is a php image gallery.May 8, 2026
- High7.8PHPUnit is a testing framework for PHP.May 8, 2026
- Critical9.8Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint.May 8, 2026
- Critical9.9Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.May 8, 2026
- Critical9.1Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property.May 8, 2026
- Medium5.4SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.May 8, 2026
- Medium6.3SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].May 8, 2026
- High7.3Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page.May 8, 2026
- High7.1FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.May 7, 2026
- High7.7FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.May 7, 2026
- High7.6FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.May 7, 2026
- Medium5.4FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.May 7, 2026
- Critical9.1FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.May 7, 2026
- Medium5.4A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page.May 7, 2026