PatchFirst · Vulnérabilités récentes
Vulnérabilités publiées pour PHP au cours des 30 derniers jours : 222. Présentes dans le catalogue KEV : 2.
Signalements récents de vulnérabilités issus des annonces des éditeurs et de l’actualité de la sécurité. Ces alertes ne modifient pas la note de sécurité.
Selon OpenNet, PHP présente une vulnérabilité d’exécution de code à distance (CVE-2026-115560). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de PHP contenant le correctif est disponible et installez-la.
CVE-2026-115560
Vulnérabilités : 7239
Failing to properly encode editor input, the search result view of indexed_search is susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML.
The flashplayer misses to validate flash and image files. Therefore it is possible to embed flash videos from external domains.
Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript.
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.
Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.
The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.
Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
It has been discovered, that calling a PHP script which is delivered with TYPO3 for testing purposes, discloses the absolute server path to the TYPO3 installation.
The backend login has a basic brute force protection implementation which pauses for 5 seconds if wrong credentials are given. This pause however could be bypassed by forging a special request, making brute force attacks on backend editor credentials more feasible.
It has been discovered, that editors with access to the file list module could list all files names and folder names in the root directory of a TYPO3 installation. Modification of files, listing further nested directories or retrieving file contents was not possible. A valid backend user account is needed to exploit this vulnerability.
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.