PatchFirst · Vulnérabilités récentes
Vulnérabilités publiées pour PHP au cours des 30 derniers jours : 222. Présentes dans le catalogue KEV : 2.
Signalements récents de vulnérabilités issus des annonces des éditeurs et de l’actualité de la sécurité. Ces alertes ne modifient pas la note de sécurité.
Selon OpenNet, PHP présente une vulnérabilité d’exécution de code à distance (CVE-2026-115560). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de PHP contenant le correctif est disponible et installez-la.
CVE-2026-115560
Vulnérabilités : 7239
Server-Side Request Forgery (SSRF) vulnerability in WPGraphQL.This issue affects WPGraphQL: from n/a through 1.14.5.
Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP files crafted to look like images may be uploaded. This only affects forms using the "Forms" feature and not just _any_ arbitrary form. This does not affect the control panel. This issue has been patched in 3.4.13 and 4.33.0.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the error message in `WebhookController` returns unescaped user-submitted input. As of version 6.3.8, `WebhookController` now doesn't return any user-submitted input in its response.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means of checking the user identifier. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible sess
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.
Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
The course upload preview contained an XSS risk for users uploading unsafe data.
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.
A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.
blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This vulnerability has been patched in version 5.1.4.
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.