Injection and Smuggling

Every one of the 13 is a mark on the map. Named now: 1 to 13, most at risk first.

1. Command injection via array-ish $command parameter of proc_open()CVE-2024-1874PHP Group · CVSS 9.4 · 33% likely

   CWE-116

2. Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)CVE-2024-5585PHP Group · CVSS 7.7 · 29% likely

   CWE-116

3. Special characters break path parsing in XML functionsCVE-2021-21707PHP Group · CVSS 5.3 · 25% likely

   CWE-159

4. PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to ov…CVE-2017-5630Php · 13% likely

   CWE-74

5. ext/session/session.c in PHP before 5.6.25 and 7.x before 7.0.10 skips invalid session names in a way that triggers incorrect parsing, which allows remote attackers to inject arbi…CVE-2016-7125Php · 5.8% likely

   CWE-74

6. The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in…CVE-2013-1824Php · 4.3% likely

   CWE-611

7. ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, whi…CVE-2015-8866Php · 4.2% likely

   CWE-611

8. PDO::quote() may return unquoted stringCVE-2022-31631PHP Group · CVSS 9.1 · 2.2% likely

   CWE-74

9. Security issue with external entity loading in XML without enabling itCVE-2023-3823PHP Group · CVSS 8.6 · 1.6% likely

   CWE-611

10. Erroneous parsing of multipart form dataCVE-2024-8925PHP Group · CVSS 3.1 · 0.9% likely

    CWE-444

11. FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Allows Execution of Non-PHP FilesCVE-2026-45062php · CVSS 8.1 · 0.7% likely

    CWE-176

12. The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local us…CVE-2013-6501Php · 0.6% likely

    CWE-74

13. PHP-FPM logs from children may be alteredCVE-2024-9026PHP Group · CVSS 3.3 · 0.5% likely

    CWE-158

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.