PHP vulnerabilities
We track 19 vulnerabilities in PHP products across 6 products. 19 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest PHP vulnerabilities
- 7.4 High severity
frankenphp: Authentication Bypass by Spoofing
FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X
- 8.1 High severity
frankenphp: Out-of-bounds Write
FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applicatio
- 7.7 High severity
frankenphp: Concurrent Execution using Shared Resource with Improper Synchronization
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, FrankenPHP worker mode can retain PHP session state between requests when the session extension is loaded as a shared module and is unavailable through HAVE_PHP_SESSION at compile time. In thi
- 8.1 High severity
FrankenPHP is a modern application server for PHP.
FrankenPHP is a modern application server for PHP. From version 1.11.2 to before version 1.12.3, the splitPos() function in cgi.go misuses golang.org/x/text/search with search.IgnoreCase when the request path contains a non-ASCII byte. Two distinct flaws in th
- 9.8 Critical severity
frankenphp: Incorrect Behavior Order: Validate Before Canonicalize
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly handles Unicode characters during case conversion. The logic computes the split index (for finding .php) on a lowercased copy of the request pa
- 7.5 High severity
frankenphp: Improper Privilege Management
FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSION superglobal is not correctly reset between requests. This allows a subsequent request processed by the same worker to access the $_SESSION
- 9.8 Critical severity
best_courier_management_system: Improper Control of Generation of Code
File Upload vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the admin_class.php component.
- 9.8 Critical severity
best_courier_management_system: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in Best courier management system in php v.1.0 allows a remote attacker to execute arbitrary code via the email parameter of the login request.
- 9.8 Critical severity
best_house_rental_management_system: Improper Control of Generation of Code
SQL Injection vulnerability in Best House rental management system project in php v.1.0 allows a remote attacker to execute arbitrary code via the username parameter of the login request.
- 7.5 High severity
PHP: Insufficient Granularity of Access Control
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controll
- 8.8 High severity
PHP: Improper Neutralization of Special Elements used in an OS Command
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the sa
- 8.8 High severity
PHP: Improper Encoding or Escaping of Output
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping,
- 9.8 Critical severity
Node.js: Improper Neutralization of Special Elements used in a Command
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
- 9.8 Critical severity
student_enrollment: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
- 9.8 Critical severity
RUGGEDCOM APE1808: Integer Overflow or Wraparound
The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.
- 7.5 High severity
PEAR Archive_Tar Improper Link Resolution Exploited
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
- 7.8 High severity
PEAR Archive_Tar Deserialization of Untrusted Data Exploited
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
- 9.8 Critical severity
PHP FastCGI Process Manager (FPM) Buffer Overflow Exploited
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility
- 7.5 High severity
PHP-CGI Query String Parameter Exploited
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing co