Approved changes feed: RSS · Atom
cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*
part: a version: 8.1.0 update: *
| Vendor | Php Group (92a56395-c1b3-5edb-8b1f-05390af3a68e) |
|---|---|
| Product | Php (35c209c6-ba98-5de5-8cfd-39b8dfcb2e71) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-4577 |
vulnerable | 2026-06-08 06:50:18.195102 |
Argument Injection in PHP-CGI
CRITICAL (9.8)
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Published: 2024-06-09T19:42:36.464Z
Updated: 2025-10-21T23:05:16.089Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3096 |
vulnerable | 2026-06-08 06:41:52.395163 |
PHP function password_verify can erroneously return true when argument contains NUL
MEDIUM (6.5)
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
Published: 2024-04-29T03:42:04.093Z
Updated: 2025-11-04T17:19:57.320Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1874 |
vulnerable | 2026-06-08 06:27:14.793143 |
Command injection via array-ish $command parameter of proc_open()
CRITICAL (9.4)
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Published: 2024-04-29T03:57:35.624Z
Updated: 2025-11-04T18:22:36.621Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0567 |
vulnerable | 2026-06-08 05:52:31.935244 |
password_verify() always returns true for some invalid hashes
HIGH (7.7)
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.
Published: 2023-02-16T06:15:50.127Z
Updated: 2026-07-19T18:24:30.482Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.