p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de la pila PHP · Página 115

Vulnerabilidades publicadas para PHP en los últimos 30 días: 222. Incluidas en el catálogo KEV: 2.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
PHP

Alertas tempranas

Avisos recientes de vulnerabilidades procedentes de anuncios de fabricantes y noticias de seguridad. Estas alertas no cambian la puntuación de seguridad.

  1. php

    Sin corrección publicada

    PHP: ejecución remota de código

    Según OpenNet, PHP tiene una vulnerabilidad de ejecución remota de código (CVE-2026-115560). No se especifican las versiones exactas afectadas. El mensaje no indica una versión corregida.

    Qué hacer ahora: Comprueba si hay una actualización de PHP con la corrección e instálala.

    CVE-2026-115560

    opennet ↗the-hacker-news ↗

Vulnerabilidades: 7239

  1. CVE-2025-31688

    Media · CVSS 6.8EPSS 0,19%Corrección disponible

    Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.

    configuration split drupal/config_split drupal/config_split drupal/config_splitPHP
    • Actualiza a 1.10.0
    • Actualiza a 2.0.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  2. CVE-2025-31687

    Media · CVSS 6.1EPSS 0,26%Corrección disponible

    SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.

    spamspan filter drupal/spamspan drupal/spamspanPHP
    • Actualiza a 3.2.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  3. CVE-2025-31686

    Alta · CVSS 8.1EPSS 0,41%Corrección disponible

    Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

    open social goalgorilla/open_social goalgorilla/open_socialPHP
    • Actualiza a 12.3.11
    • Actualiza a 12.4.10
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  4. CVE-2025-31685

    Crítica · CVSS 9.1EPSS 0,39%Corrección disponible

    Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014

    Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.

    open social goalgorilla/open_social goalgorilla/open_socialPHP
    • Actualiza a 12.3.11
    • Actualiza a 12.4.10
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  6. CVE-2025-31683

    Media · CVSS 6.8EPSS 0,18%Corrección disponible

    Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

    google tag drupal/google_tag drupal/google_tag drupal/google_tagPHP
    • Actualiza a 1.8.0
    • Actualiza a 2.0.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  7. CVE-2025-31682

    Media · CVSS 4.8EPSS 0,24%Corrección disponible

    Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.

    google tag drupal/google_tag drupal/google_tag drupal/google_tagPHP
    • Actualiza a 1.8.0
    • Actualiza a 2.0.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  10. CVE-2025-31679

    Media · CVSS 6.1EPSS 0,26%Corrección disponible

    Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.

    ignition error pages drupal/ignition drupal/ignitionPHP
    • Actualiza a 1.0.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  11. CVE-2025-31678

    Alta · CVSS 8.2EPSS 0,38%Corrección disponible

    AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004

    Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.

    ai (artificial intelligence) drupal/ai drupal/aiPHP
    • Actualiza a 1.0.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  12. CVE-2025-31677

    Alta · CVSS 8.8EPSS 0,23%Corrección disponible

    AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.

    ai (artificial intelligence) drupal/ai drupal/aiPHP
    • Actualiza a 1.0.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  13. CVE-2025-31676

    Alta · CVSS 8.8EPSS 0,57%Corrección disponible

    Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001

    Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.

    email tfa drupal/email_tfaPHP
    • Actualiza a 2.0.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  14. CVE-2025-31675

    Media · CVSS 5.4EPSS 0,5%Corrección disponible

    Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.

    drupal core link drupal/core drupal/core drupal/core drupal/core drupal/corePHP
    • Actualiza a 10.3.14
    • Actualiza a 10.4.5
    • Actualiza a 11.0.13
    • Actualiza a 11.1.5
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  15. CVE-2025-31674

    Alta · CVSS 7.5EPSS 0,6%Corrección disponible

    Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

    Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    drupal core drupal/core drupal/core drupal/core drupal/core drupal/corePHP
    • Actualiza a 10.3.13
    • Actualiza a 10.4.3
    • Actualiza a 11.0.12
    • Actualiza a 11.1.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  16. CVE-2025-31673

    Media · CVSS 4.6EPSS 0,32%Corrección disponible

    Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002

    Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    drupal core drupal/core drupal/core drupal/core drupal/core drupal/corePHP
    • Actualiza a 10.3.13
    • Actualiza a 10.4.3
    • Actualiza a 11.0.12
    • Actualiza a 11.1.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  17. CVE-2025-3057

    Media · CVSS 6.1EPSS 0,31%Corrección disponible

    Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.

    drupal core drupal/core drupal/core drupal/core drupal/core drupal/corePHP
    • Actualiza a 10.3.13
    • Actualiza a 10.4.3
    • Actualiza a 11.0.12
    • Actualiza a 11.1.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  19. CVE-2025-2967

    Media · CVSS 5.1Sin corrección publicada

    ConcreteCMS Cross-Site Scripting (XSS) via HTML Block Text Field

    A vulnerability was found in ConcreteCMS up to 9.3.9. It has been classified as problematic. This affects the function Save of the component HTML Block Handler. The manipulation of the argument content leads to HTML injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

    concrete5/concrete5PHP
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2025-1861

    Media · CVSS 6.3EPSS 0,86%Corrección disponible

    Stream HTTP wrapper truncates redirect location to 1024 bytes

    In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when parsing HTTP redirect in the response to an HTTP request, there is currently limit on the location value size caused by limited size of the location buffer to 1024. However as per RFC9110, the limit is recommended to be 8000. This may lead to incorrect URL truncation and redirecting to a wrong location.

    php php8.2 php8.4 php8.4 php5 php7.0 php7.2 php7.4 php8.1 php8.3Sistemas operativos PHP
    • Actualiza a 7.0.33-0ubuntu0.16.04.16+esm15
    • Actualiza a 7.2.24-0ubuntu0.18.04.17+esm8
    • Actualiza a 7.4.3-4ubuntu2.29
    • Actualiza a 8.1.2-1ubuntu2.21
    • Actualiza a 8.1.32
    • Actualiza a 8.2.28
    • Actualiza a 8.2.28-1~deb12u1
    • Actualiza a 8.3.19
    • Actualiza a 8.3.6-0ubuntu0.24.04.4
    • Actualiza a 8.4.5
    • Actualiza a 8.4.5-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →