GCVE - cpe:2.3:a:thinkphp:thinkphp:3.2.4:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:thinkphp:thinkphp:3.2.4:*:*:*:*:*:*:*

part: a version: 3.2.4 update: *

Notes

Imported from NVD CPE 2.0 feed

PURL	Source	Last updated
`pkg:bitbucket/silenceper/thinkphp`	purl2cpe	2026-06-01 10:12:58.516613
`pkg:github/top-think/framework`	purl2cpe	2026-06-01 10:12:58.516614
`pkg:sourceforge/thinkphp`	purl2cpe	2026-06-01 10:12:58.516616

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-18546`	vulnerable	2026-06-08 05:11:14.223950	Details available ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable. Published: 2018-10-21T01:00:00.000Z Updated: 2024-09-17T00:22:01.293Z Open on db.gcve.eu Reference links https://github.com/top-think/thinkphp/commit/9748cb80d2f24c89218f358ca2f5ab88ee33396f https://98587329.github.io/2018/10/09/thinkphp%E6%B3%A8%E5%85%A5%E5%88%86%E6%9E%90/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-18529`	vulnerable	2026-06-08 05:11:14.209584	Details available ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI. Published: 2018-10-19T20:00:00.000Z Updated: 2024-09-16T22:20:52.675Z Open on db.gcve.eu Reference links https://www.kingkk.com/2018/10/Thinkphp-%E8%81%9A%E5%90%88%E6%9F%A5%E8%AF%A2%E6%BC%8F%E6%B4%9E/#ThinkPHP3-lt-3-2-4	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.