CVEs
Every published CVE. Without a filter the list holds those exploited, with a public check, or likely to be exploited; pick a year and month or a vendor for the rest.
PHP has 759 CVEs, 6 exploited. Pick a weakness or a product to list them.
By weakness
- Memory Corruption246 · 3 exploited
- Input Validation and Logic79
- Denial of Service36
- Other weaknesses36
- Access Control35
- Information Disclosure34
- Command and Code Injection17 · 3 exploited
- File and Path Handling17
- Injection and Smuggling13
- Cross-site Scripting10
- Cryptography8
- Deserialization and Object Injection6
- SQL Injection5
- Race Conditions4
- Authentication2
- Server-Side Request Forgery2
- Misconfiguration and Insecure Design1
- Open Redirect1
- Supply Chain and Malicious Code1
- No weakness recorded206
By product
- PHP704 · 5 exploited
- frankenphp20
- Pear5
- Archive Tar2
- Pearweb2
- Php Script Index2
- Animated Smiley Generator1
- Ar Memberscript1
- Blog Cms1
- Bloq1
- Com Extensions1
- Directory Listing Script1
- Errordocs1
- Ext-Http1
- F1 Maxs File Uploader1
- Memcached1
- Mysql Banner Exchange1
- Mysql Extension1
- Pear Archive Tar1
- Pear Html Quickform Controller1
- Pecl Http1
- PHP 7.x1
- PHP before 5.6.281
- PHP before 7.0.121
- Php Fi1
- PHP Imagick extension1
- PHPMailer1 · 1 exploited
- Phpsquidpass1
- Xhprof1
- Xml Rpc1
Exploitation: exploited (CISA KEV), a public nuclei check, then EPSS: likely 10% or more, possible 1 to 10%, unlikely under 1%. Data as of 2026-11-14.