CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
| CVE | Vendor · product | Exploitation | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-2311sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that contain a %3D sequence… | Php · Php | Likely | – | 69% | 2012-05-11 |
| CVE-2010-4700The set_magic_quotes_runtime function in PHP 5.3.2 and 5.3.3, when the MySQLi extension is used, does not properly interact with use of the mysqli_fetch_assoc function, which migh… | Php · Php | Possible | – | 1.5% | 2011-01-18 |
| CVE-2025-1735pgsql extension does not check for errors during escaping | PHP Group · PHP | Possible | 5.9 | 1.2% | 2025-07-13 |
| CVE-2025-14179SQL injection in pdo_firebird via NUL bytes in quoted strings | PHP Group · PHP | Unlikely | 8.1 | 0.4% | 2026-05-10 |
| CVE-2026-17543SQL injection in ext-pgsql via E'...' backslash breakout | PHP Group · PHP | Unlikely | 8.1 | 0.3% | 2026-07-30 |
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-14.