PHP · weakness class
Input Validation and Logic
16 CVEs
Out of date: the sync last ran 4 hours ago. Newer CVEs and scores may be missing from the map.
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- likely to be exploited
- 2
Every one of the 16 is a mark on the map. Named now: 1 to 16, most at risk first.
- $_COOKIE names string replacement (. -> _): cookie integrity vulnerabilities
- __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix
- PHP parses encoded cookie names so malicious `__Host-` cookies can be sent
- FILTER_VALIDATE_URL accepts URLs with invalid userinfo
- Incorrect URL validation in FILTER_VALIDATE_URL
- Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV
- PHP function password_verify can erroneously return true when argument contains NUL
- Configuring a proxy in a stream context might allow for CRLF injection in URIs
- Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP
- FrankenPHP affected by Path Confusion via Unicode casing in CGI path splitting allows execution of arbitrary files
- Header parser of http stream wrapper does not handle folded headers
- Stream HTTP wrapper header check might omit basic auth header
- Streams HTTP wrapper does not fail for headers with invalid name and no colon
- IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
- FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos
- FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.