PHP vendor intelligence
PHP Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting PHP products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 24
- Known exploited vulnerabilities affecting PHP products
- In CISA KEV
- 7
- Records also listed in the official catalog
- Beyond CISA KEV
- 17
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 5
- PHP KEVs with sensor-observed exploitation activity
The catalog gap matters for PHP exposure
Seventeen of the 24 exploited PHP vulnerabilities tracked by Previdian are not in CISA KEV. Teams relying on the official catalog alone would miss 71% of this vendor portfolio.
- 29%
- Covered by CISA
- 71%
- Beyond CISA
- 20
- Product families
Attested PHP vulnerabilities
24 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2026-6433
Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE |
Custom CSS JS PHP | Confirmed | Beyond CISA | 02 Oct 2026 |
|
CVE-2021-30134
php-mod/curl (a wrapper of the PHP cURL extension) before 2.3.2 allows XSS via the post_file_path_upload.php key parameter and the POST data to... |
PHP Curl Class, HT Slider Range FOR Amazon Affiliates, Woo-qiwi-payment-gateway, Teamleader CRM Forms, Invoicing With Invoicexpress FOR Woocommerce, Shopello API | High | Beyond CISA | 21 Sep 2026 |
|
CVE-2026-48611
Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to... |
phpBB | Confirmed | Beyond CISA | 20 Jul 2026 |
|
CVE-2020-24949
Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server... |
PHP-Fusion | High | Beyond CISA | 15 Jun 2026 |
|
CVE-2020-20300
SQL injection vulnerability in the wp_where function in WeiPHP 5.0. |
WeiPHP 5.0 | High | Beyond CISA | 14 Apr 2026 |
|
CVE-2020-22165
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can... |
Hospital Management System | High | Beyond CISA | 13 Feb 2026 |
|
CVE-2023-40748
PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php. |
Food Delivery Script | High | Beyond CISA | 26 Jan 2026 |
|
CVE-2019-9762
A SQL Injection was discovered in PHPSHE 1.7 in include/plugin/payment/alipay/pay.php with the parameter id. The vulnerability does not need any... |
PHPSHE 1.7 | High | Beyond CISA | 30 Dec 2025 |
|
CVE-2017-6090
Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute... |
PhpCollab | High | Beyond CISA | 05 Jul 2025 |
|
CVE-2022-47945
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled... |
ThinkPHP Framework | Confirmed | Beyond CISA | 21 Jun 2025 |
|
CVE-2016-10033
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command... |
PHPMailer | Confirmed | In CISA | 01 Jun 2026 |
|
CVE-2012-2376
Buffer overflow in the com_print_typeinfo function in PHP 5.4.3 and earlier on Windows allows remote attackers to execute arbitrary code via... |
PHP | High | Beyond CISA | 21 May 2012 |
|
CVE-2011-4075
The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby... |
phpLDAPadmin | High | Beyond CISA | 02 Nov 2011 |
|
CVE-2008-5227
Unspecified vulnerability in PHPCow allows remote attackers to execute arbitrary code via unknown vectors, related to a "file inclusion... |
PHPCow | High | Beyond CISA | 25 Nov 2008 |
|
CVE-2019-5127
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable... |
YouPHPTube" | High | Beyond CISA | 25 Apr 2025 |
|
CVE-2019-5129
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable... |
YouPHPTube | High | Beyond CISA | 25 Apr 2025 |
|
CVE-2019-5128
A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable... |
YouPHPTube | High | Beyond CISA | 27 Apr 2025 |
|
CVE-2019-9082
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via... |
ThinkPHP | Confirmed | In CISA | 03 Nov 2021 |
|
CVE-2017-9841
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data... |
PHPUnit | Confirmed | In CISA | 15 Feb 2022 |
|
CVE-2009-1151
Static code injection vulnerability in setup.php in phpMyAdmin 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 allows remote attackers to inject... |
phpMyAdmin | Confirmed | In CISA | 25 Mar 2022 |
|
CVE-2012-1823
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query... |
PHP | Confirmed | In CISA | 25 Mar 2022 |
|
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE |
PHP | Confirmed | In CISA | 25 Mar 2022 |
|
CVE-2024-4577
Argument Injection in PHP-CGI |
PHP | Confirmed | In CISA | 12 Jun 2024 |
|
CVE-2021-44892
A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain... |
ThinkPHP 3.x.x | High | Beyond CISA | 10 Feb 2022 |
No PHP vulnerabilities match this search or filter.
Showing 24 of 24 on this page (24 PHP known exploited vulnerabilities).
Recurring weakness patterns
Control, neutralization, and neutralization account for thirteen mapped occurrences across this PHP KEV portfolio.
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-287
Improper Authentication
CWE-306
Missing Authentication for Critical Function
CWE-434
Unrestricted Upload of File with Dangerous Type
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')