Sploitus

558 exploited vulnerabilities in Php

Showing 1–50 of 558, highest-scoring first

Vendors
Php, Tinyweb, Alpine, Debian, Laravel, Nginx
With known exploits
558
Affected Ritlabs Tinyweb versions
< 2.01
Affected Vasion Virtual Appliance Application versions
< 20.0.2614
Affected Vasion Virtual Appliance Host versions
< 22.0.1002
Affected Vbulletin versions
≀ 5.7.5, 6.0.3
Affected Php versions
< 8.1.31, 8.2.26, 8.3.14, 8.1.30, 8.2.24, 8.3.12, 8.0.30, 8.1.22, 8.2.9, 8.1.8, 7.4.30, 8.0.20, 8.1.7, 7.1.27, 7.2.16, 7.3.3, 7.1.5, 7.4.23, 8.0.10, 7.0.0, 7.0.1, 7.0.2, 5.5.36, 5.6.0, 5.6.1, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.10, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.18, 5.6.19, 5.6.20, 5.6.21, 5.6.22, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 5.5.37, 5.6.23, 7.0.8, 5.6.25, 7.0.9, 7.0.10, 5.6.24
Affected Glpi-project Glpi versions
< 10.0.11
Affected Dompdf Project Dompdf versions
= 2.0.1
Affected Impresscms versions
< 1.4.2

Vulnerabilities with exploits

Highest CVSS first β€” 16 of these already have exploit code on Sploitus

CVE-2026-27613
CVSS 10.0 CRITICAL 2026-02-25FIX AVAILABLE
CVE-2025-34203
CVSS 10.0 CRITICAL 2025-09-19FIX AVAILABLE
CVE-2025-48827 3 exploits
CVSS 10.0 CRITICAL 2025-05-23
πŸ“„ vBulletin 6.0.3 replaceAdTemplate Expression InjectionExploit for Improper Protection of Alternate Path in Vbulletin
CVE-2024-8932
CVSS 10.0 CRITICAL 2024-11-15FIX AVAILABLE
CVE-2024-11236
CVSS 10.0 CRITICAL 2024-11-20FIX AVAILABLE
CVE-2024-9026
CVSS 10.0 HIGH 2019-06-02FIX AVAILABLE
CVE-2024-8927
CVSS 10.0 HIGH 2019-06-02FIX AVAILABLE
CVE-2024-8926 1 exploit
CVSS 10.0 HIGH 2019-06-02FIX AVAILABLE
Exploit for OS Command Injection in Php
CVE-2024-8925
CVSS 10.0 HIGH 2019-06-02FIX AVAILABLE
CVE-2024-29895 4 exploits
CVSS 10.0 CRITICAL 2024-03-27FIX AVAILABLE
Exploit for CVE-2024-29895Exploit for CVE-2024-29895
CVE-2023-46726
CVSS 10.0 HIGH 2023-12-13FIX AVAILABLE
CVE-2023-3824 2 exploits
CVSS 10.0 CRITICAL 2023-08-03FIX AVAILABLE
Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in PhpExploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Php
CVE-2023-24813
CVSS 10.0 CRITICAL 2023-02-07FIX AVAILABLE
CVE-2023-23924 1 exploit
CVSS 10.0 CRITICAL 2023-01-31FIX AVAILABLE
Exploit for Incorrect Behavior Order: Authorization Before Parsing and Canonicalization in Dompdf_Project Dompdf
CVE-2022-24977
CVSS 10.0 CRITICAL 2022-02-13FIX AVAILABLE
CVE-2022-31625
CVSS 10.0 CRITICAL 2022-02-27FIX AVAILABLE
CVE-2022-31627
CVSS 10.0 HIGH 2022-06-27FIX AVAILABLE
CVE-2022-31626 1 exploit
CVSS 10.0 HIGH 2022-05-16FIX AVAILABLE
Exploit for Classic Buffer Overflow in Php
CVE-2021-21708
CVSS 10.0 CRITICAL 2021-02-14FIX AVAILABLE
CVE-2020-7065
CVSS 10.0 HIGH 2020-03-17FIX AVAILABLE
CVE-2019-9641 1 exploit
CVSS 10.0 CRITICAL 2019-03-08FIX AVAILABLE
Exploit for Stack-based Buffer Overflow in Tenda Ac10_Firmware
CVE-2017-9120
CVSS 10.0 CRITICAL 2017-06-11FIX AVAILABLE
CVE-2016-2554
CVSS 10.0 CRITICAL 2016-02-25FIX AVAILABLE
CVE-2016-5768
CVSS 10.0 CRITICAL 2016-06-24FIX AVAILABLE
CVE-2016-5770
CVSS 10.0 CRITICAL 2016-07-05FIX AVAILABLE
CVE-2016-5771 4 exploits
CVSS 10.0 CRITICAL 2016-06-24FIX AVAILABLE
Kerio Control Unified Threat Management 9.1.0 build 1087 / 9.1.1 build 1324 - Multiple VulnerabilitiKerio Control Unified Threat Management 9.1.0 build 10879.1.1 build 1324 - Multiple Vulnerabilities
CVE-2016-5772
CVSS 10.0 CRITICAL 2016-06-24FIX AVAILABLE
CVE-2016-5773 4 exploits
CVSS 10.0 CRITICAL 2016-06-24FIX AVAILABLE
Kerio Control Unified Threat Management 9.1.0 build 1087 / 9.1.1 build 1324 - Multiple VulnerabilitiKerio Control Unified Threat Management 9.1.0 build 10879.1.1 build 1324 - Multiple Vulnerabilities
CVE-2016-6290
CVSS 10.0 CRITICAL 2016-07-25FIX AVAILABLE
CVE-2016-6291
CVSS 10.0 CRITICAL 2016-07-25FIX AVAILABLE
CVE-2016-6294
CVSS 10.0 CRITICAL 2016-07-25FIX AVAILABLE
CVE-2016-6295
CVSS 10.0 CRITICAL 2016-07-25FIX AVAILABLE
CVE-2016-6296
CVSS 10.0 CRITICAL 2016-07-25FIX AVAILABLE
CVE-2016-7411
CVSS 10.0 CRITICAL 2016-09-17FIX AVAILABLE
CVE-2016-7413
CVSS 10.0 CRITICAL 2016-09-17FIX AVAILABLE
CVE-2016-7414
CVSS 10.0 CRITICAL 2016-09-17FIX AVAILABLE
CVE-2016-7417
CVSS 10.0 CRITICAL 2016-09-17FIX AVAILABLE
CVE-2016-7124 1 exploit
CVSS 10.0 CRITICAL 2016-09-11FIX AVAILABLE
SugarCRM v6. 5. 23 PHP deserialize an object injection vulnerability
CVE-2016-7126
CVSS 10.0 CRITICAL 2016-09-11FIX AVAILABLE
CVE-2016-7127
CVSS 10.0 CRITICAL 2016-09-11FIX AVAILABLE
CVE-2016-7129
CVSS 10.0 CRITICAL 2016-09-11FIX AVAILABLE
CVE-2015-4642 1 exploit
CVSS 10.0 HIGH 2015-07-05FIX AVAILABLE
Nagios Core < 4.2.2 Curl Command Injection/Code Execution （CVE-2016-9565οΌ‰
CVE-2016-3141
CVSS 10.0 CRITICAL 2016-03-31FIX AVAILABLE
CVE-2015-8617 2 exploits
CVSS 10.0 HIGH 2016-01-19FIX AVAILABLE
PHP 7.0.0 - Format StringPHP 7.0.0 - Format String
CVE-2015-4599 4 exploits
CVSS 10.0 CRITICAL 2015-06-17FIX AVAILABLE
Exploit for CVE-2015-0273Exploit for CVE-2015-0273
CVE-2015-4600 4 exploits
CVSS 10.0 CRITICAL 2015-06-23FIX AVAILABLE
Exploit for CVE-2015-0273Exploit for CVE-2015-0273
CVE-2015-4602
CVSS 10.0 CRITICAL 2015-06-23FIX AVAILABLE
CVE-2015-4603 4 exploits
CVSS 10.0 CRITICAL 2015-06-17FIX AVAILABLE
Exploit for CVE-2015-0273Exploit for CVE-2015-0273
CVE-2015-5589
CVSS 10.0 CRITICAL 2015-07-20FIX AVAILABLE
CVE-2012-6046 1 exploit
CVSS 10.0 HIGH 2012-11-27
PHP Enter 4.1.2 - 'banners.php' PHP Code Injection