Approved changes feed: RSS · Atom
cpe:2.3:a:thinkphp:thinkphp:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Thinkphp (7d80de3a-ffd7-522a-baaa-15d3e22260bc) |
|---|---|
| Product | Thinkphp (3919177f-e8ed-5462-9cb8-7a0abcacbd4b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:bitbucket/silenceper/thinkphp |
purl2cpe | 2026-06-01 10:12:58.516595 |
pkg:github/top-think/framework |
purl2cpe | 2026-06-01 10:12:58.516596 |
pkg:sourceforge/thinkphp |
purl2cpe | 2026-06-01 10:12:58.516598 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-48112 |
vulnerable | 2026-06-08 06:48:13.619976 |
Details available
A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Published: 2024-10-30T00:00:00.000Z
Updated: 2024-10-31T14:07:13.314Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-44902 |
vulnerable | 2026-06-08 06:45:54.243430 |
Details available
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
Published: 2024-09-09T00:00:00.000Z
Updated: 2026-07-05T00:45:14.395Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-47945 |
vulnerable | 2026-06-08 05:50:41.000270 |
Details available
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
Published: 2022-12-23T00:00:00.000Z
Updated: 2025-04-15T13:52:17.194Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-45982 |
vulnerable | 2026-06-08 05:50:37.660940 |
Details available
thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
Published: 2023-02-08T00:00:00.000Z
Updated: 2025-03-25T14:07:03.089Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-44350 |
vulnerable | 2026-06-08 05:36:45.679568 |
Details available
SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
Published: 2021-12-15T22:09:06.000Z
Updated: 2024-08-04T04:17:25.074Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-23592 |
vulnerable | 2026-06-08 05:30:03.017074 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-20120 |
vulnerable | 2026-06-08 05:21:03.920815 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-9082 |
vulnerable | 2026-06-08 05:14:24.963465 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-25270 |
vulnerable | 2026-06-08 05:11:29.704023 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-16385 |
vulnerable | 2026-06-08 05:11:04.787445 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.