Approved changes feed: RSS · Atom
cpe:2.3:a:php_group:php:8.3.0:*:*:*:*:*:*:*
part: a version: 8.3.0 update: *
| Vendor | Php Group (92a56395-c1b3-5edb-8b1f-05390af3a68e) |
|---|---|
| Product | Php (35c209c6-ba98-5de5-8cfd-39b8dfcb2e71) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-4577 |
vulnerable | 2026-06-08 06:50:18.196835 |
Argument Injection in PHP-CGI
CRITICAL (9.8)
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
Published: 2024-06-09T19:42:36.464Z
Updated: 2025-10-21T23:05:16.089Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3096 |
vulnerable | 2026-06-08 06:41:52.396728 |
PHP function password_verify can erroneously return true when argument contains NUL
MEDIUM (6.5)
In PHP version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.
Published: 2024-04-29T03:42:04.093Z
Updated: 2025-11-04T17:19:57.320Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1874 |
vulnerable | 2026-06-08 06:27:14.794918 |
Command injection via array-ish $command parameter of proc_open()
CRITICAL (9.4)
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Published: 2024-04-29T03:57:35.624Z
Updated: 2025-11-04T18:22:36.621Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.