p PatchFirst

PatchFirst · Latest vulnerabilities

PHP stack vulnerabilities · Page 123

Vulnerabilities published for PHP in the last 30 days: 222. Listed in the KEV catalogue: 2.

RSS ↗ JSON ↗
Filter vulnerabilities
PHP

Early warnings

Fresh vulnerability reports from vendor announcements and security news. These warnings do not change the security rating.

  1. php

    No fix published

    PHP: remote code execution

    According to OpenNet, PHP has a remote code execution vulnerability (CVE-2026-115560). The exact affected versions are unspecified. The report does not name a fixed version.

    What to do now: Check whether a PHP update with the fix is available and install it.

    CVE-2026-115560

    opennet ↗the-hacker-news ↗

Vulnerabilities: 7239

  1. CVE-2024-13308

    Low · CVSS 3.8EPSS 0.26%Fix available

    Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Browser Back Button allows Cross-Site Scripting (XSS).This issue affects Browser Back Button: from 1.0.0 before 2.0.2.

    browser back button drupal/browser_back_buttonPHP
    • Update to 2.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2024-13305

    Medium · CVSS 4.8EPSS 0.24%Fix available

    Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Entity Form Steps allows Cross-Site Scripting (XSS).This issue affects Entity Form Steps: from 0.0.0 before 1.1.4.

    entity form steps drupal/entity_form_stepsPHP
    • Update to 1.1.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2024-13304

    Medium · CVSS 4.5EPSS 0.18%Fix available

    Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Minify JS allows Cross Site Request Forgery.This issue affects Minify JS: from 0.0.0 before 3.0.3.

    minify js drupal/minifyjsPHP
    • Update to 3.0.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2024-13301

    Medium · CVSS 6.1EPSS 0.25%Fix available

    OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) allows Cross-Site Scripting (XSS).This issue affects OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client): from 3.0.0 before 3.44.0, from 4.0.0 before 4.0.19.

    oauth & openid connect single sign on – sso (oauth/oidc client) drupal/miniorange_oauth_clientPHP
    • Update to 3.44.0
    • Update to 4.0.19
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2024-13298

    Medium · CVSS 4.8EPSS 0.24%Fix available

    Tarte au Citron - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-064

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tarte au Citron allows Cross-Site Scripting (XSS).This issue affects Tarte au Citron: from 2.0.0 before 2.0.5.

    tarte au citron drupal/tarte_au_citronPHP
    • Update to 2.0.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2024-13296

    Medium · CVSS 6.6EPSS 0.42%Fix available

    Mailjet - Moderately critical - Arbitrary PHP code execution - SA-CONTRIB-2024-062

    Deserialization of Untrusted Data vulnerability in Drupal Mailjet allows Object Injection.This issue affects Mailjet: from 0.0.0 before 4.0.1.

    mailjet drupal/mailjetPHP
    • Update to 4.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2024-13294

    Medium · CVSS 5.4EPSS 0.24%Fix available

    POST File - Critical - Cross Site Scripting, Arbitrary PHP code execution - SA-CONTRIB-2024-060

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal POST File allows Cross-Site Scripting (XSS).This issue affects POST File: from 0.0.0 before 1.0.2.

    post file drupal/postfilePHP
    • Update to 1.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2024-13293

    Low · CVSS 3.1EPSS 0.14%Fix available

    POST File - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-059

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal POST File allows Cross Site Request Forgery.This issue affects POST File: from 0.0.0 before 1.0.2.

    post file drupal/postfilePHP
    • Update to 1.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2024-13292

    Medium · CVSS 4.8EPSS 0.24%Fix available

    Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Tooltip allows Cross-Site Scripting (XSS).This issue affects Tooltip: from 0.0.0 before 1.1.2.

    tooltip drupal/tooltipPHP
    • Update to 1.1.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2024-13289

    Medium · CVSS 5.4EPSS 0.29%Fix available

    Cookiebot + GTM - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-055

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Cookiebot + GTM allows Cross-Site Scripting (XSS).This issue affects Cookiebot + GTM: from 0.0.0 before 1.0.18.

    cookiebot + gtm drupal/cookiebot_gtmPHP
    • Update to 1.0.18
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2024-13288

    Medium · CVSS 4.3EPSS 0.36%Fix available

    Monster Menus - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-052

    Deserialization of Untrusted Data vulnerability in Drupal Monster Menus allows Object Injection.This issue affects Monster Menus: from 0.0.0 before 9.3.4, from 9.4.0 before 9.4.2.

    monster menus drupal/monster_menusPHP
    • Update to 9.3.4
    • Update to 9.4.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2024-13287

    Medium · CVSS 5.4EPSS 0.22%Fix available

    Views SVG Animation - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-051

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Views SVG Animation allows Cross-Site Scripting (XSS).This issue affects Views SVG Animation: from 0.0.0 before 1.0.1.

    views svg animation drupal/views_svg_animationPHP
    • Update to 1.0.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2024-13286

    Medium · CVSS 5.4EPSS 0.22%Fix available

    SVG Embed - Moderately critical - Cross site scripting - SA-CONTRIB-2024-050

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SVG Embed allows Cross-Site Scripting (XSS).This issue affects SVG Embed: from 0.0.0 before 2.1.2.

    svg embed drupal/svg_embedPHP
    • Update to 2.1.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2024-13284

    High · CVSS 8.8EPSS 0.2%Fix available

    Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Gutenberg allows Cross Site Request Forgery.This issue affects Gutenberg: from 0.0.0 before 2.13.0, from 3.0.0 before 3.0.5.

    gutenberg drupal/gutenbergPHP
    • Update to 2.13.0
    • Update to 3.0.5
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2024-13283

    Medium · CVSS 6.1EPSS 0.24%Fix available

    Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Facets allows Cross-Site Scripting (XSS).This issue affects Facets: from 0.0.0 before 2.0.9.

    facets drupal/facetsPHP
    • Update to 2.0.9
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →