Sploitus

23 exploited vulnerabilities in Thinkphp

Vulnerabilities with publicly known exploits

Vendors
Thinkphp, Unknown, None, Git, 74Cms, Topthink
With known exploits
23
Affected Thinkphp versions
= 5.1.0, 6.0.8, 3.2.4, 5.0.23, 5.1.31, 8.0.4, 6.0.13, 6.1.0, 6.0.12, 3.2.3, 5.1.25, 5.1.24, 5.1.23, 5.0.24, 5.1.41, 8.0.3
Affected 5none Nonecms versions
= 1.3.0
Affected 74cms versions
= 5.0.1
Affected Tpcms Project Tpcms versions
= 3.2
Affected Gxlcms versions
= 1.0

Vulnerabilities with exploits

Highest CVSS first — 3 of these already have exploit code on Sploitus

CVE-2025-50706
CVSS 10.0 CRITICAL 2024-04-24FIX AVAILABLE
CVE-2021-36567
CVSS 10.0 CRITICAL 2021-12-06
CVE-2019-9082 9 exploits
CVSS 10.0 HIGH 2019-01-12FIX AVAILABLE
Vulmap - Web Vulnerability Scanning And Verification ToolsThinkPHP - Multiple PHP Injection RCEs (Metasploit)
CVE-2018-20062 5 exploits
CVSS 10.0 CRITICAL 2018-12-11FIX AVAILABLE
Vulmap - Web Vulnerability Scanning And Verification ToolsThinkPHP - Multiple PHP Injection RCEs (Metasploit)
CVE-2018-25270
CVSS 9.8 CRITICAL 2026-04-22
CVE-2024-48112
CVSS 9.8 CRITICAL 2024-10-30FIX AVAILABLE
CVE-2024-44902 1 exploit
CVSS 9.8 CRITICAL 2024-09-09
Exploit for Deserialization of Untrusted Data in Thinkphp
CVE-2022-45982
CVSS 9.8 CRITICAL 2023-02-08FIX AVAILABLE
CVE-2022-38352
CVSS 9.8 CRITICAL 2022-09-15FIX AVAILABLE
CVE-2022-33107
CVSS 9.8 CRITICAL 2022-06-29FIX AVAILABLE
CVE-2021-36564
CVSS 9.8 CRITICAL 2021-12-06
CVE-2020-35339
CVSS 9.8 CRITICAL 2021-02-17FIX AVAILABLE
CVE-2020-20120
CVSS 9.8 CRITICAL 2021-09-28FIX AVAILABLE
CVE-2018-18546
CVSS 9.8 CRITICAL 2018-10-21
CVE-2018-18530
CVSS 9.8 CRITICAL 2018-10-19
CVE-2018-18529
CVSS 9.8 CRITICAL 2018-10-19FIX AVAILABLE
CVE-2018-17566
CVSS 9.8 CRITICAL 2018-09-26FIX AVAILABLE
CVE-2018-16385
CVSS 9.8 CRITICAL 2018-09-03FIX AVAILABLE
CVE-2022-44289
CVSS 8.8 HIGH 2022-12-06FIX AVAILABLE
CVE-2021-44892
CVSS 8.8 HIGH 2022-02-10FIX AVAILABLE
CVE-2022-27442
CVSS 7.5 HIGH 2022-04-04
CVE-2024-34467
CVSS 6.1 MEDIUM 2024-05-04
CVE-2018-16655
CVSS 6.1 MEDIUM 2018-09-07FIX AVAILABLE