SWSandworm Watch
target entity

PHP

4 source-linked records in the current knowledge graph.

high

CVE-2016-10033: PHPMailer Command Injection Vulnerability

PHPMailer contains a command injection vulnerability because it fails to sanitize user-supplied input. Specifically, this issue affects the 'mail()' function of 'class.phpmailer.php' script. An attacker can exploit this issue to execute arbitrary code within the context of the application. Failed exploit attempts will result in a denial-of-service condition. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2016-10033EPSS 99.7%PHPPHPMailer
CISA KEV ↗ · unattributed attribution · 1 IOC
high

CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability

PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVE-2012-1823CVE-2024-4577EPSS 100.0%PHPPHP Group
CISA KEV ↗ · unattributed attribution
high

CVE-2012-1823: PHP-CGI Query String Parameter Vulnerability

sapi/cgi/cgi_main.c in PHP, when configured as a CGI script, does not properly handle query strings, which allows remote attackers to execute arbitrary code. Required action: Apply updates per vendor instructions.

CVE-2012-1823EPSS 100.0%PHP
CISA KEV ↗ · unattributed attribution