PatchFirst · Vulnérabilités récentes
Vulnérabilités publiées pour PHP au cours des 30 derniers jours : 222. Présentes dans le catalogue KEV : 2.
Signalements récents de vulnérabilités issus des annonces des éditeurs et de l’actualité de la sécurité. Ces alertes ne modifient pas la note de sécurité.
Selon OpenNet, PHP présente une vulnérabilité d’exécution de code à distance (CVE-2026-115560). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de PHP contenant le correctif est disponible et installez-la.
CVE-2026-115560
Vulnérabilités : 7239
This module enables you to secure any page with a password. The module does not sufficiently restrict access to the page content.
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in yuan1994 tpAdmin 1.3.12. Affected is the function remote of the file application\admin\controller\Upload.php. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225408. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in yuan1994 tpAdmin 1.3.12. This issue affects the function Upload of the file application\admin\controller\Upload.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225407. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Business Logic Errors in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Authentication Bypass by Capture-replay in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Command Injection in GitHub repository microweber/microweber prior to 1.3.3.
Insufficient Session Expiration in GitHub repository firefly-iii/firefly-iii prior to 6.
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the application does not correctly validate the message sent by the clients in the ticket.
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers.
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.