p PatchFirst

PatchFirst · Latest vulnerabilities

PHP stack vulnerabilities · Page 124

Vulnerabilities published for PHP in the last 30 days: 222. Listed in the KEV catalogue: 2.

RSS ↗ JSON ↗
Filter vulnerabilities
PHP

Early warnings

Fresh vulnerability reports from vendor announcements and security news. These warnings do not change the security rating.

  1. php

    No fix published

    PHP: remote code execution

    According to OpenNet, PHP has a remote code execution vulnerability (CVE-2026-115560). The exact affected versions are unspecified. The report does not name a fixed version.

    What to do now: Check whether a PHP update with the fix is available and install it.

    CVE-2026-115560

    opennet ↗the-hacker-news ↗

Vulnerabilities: 7239

  2. CVE-2024-13280

    Critical · CVSS 9.8EPSS 0.42%Fix available

    Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044

    Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.This issue affects Persistent Login: from 0.0.0 before 1.8.0, from 2.0.* before 2.2.2.

    persistent login drupal/persistent_loginPHP
    • Update to 1.8.0
    • Update to 2.1.0
    • Update to 2.2.0
    • Update to 2.2.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2024-13278

    Critical · CVSS 9.1EPSS 0.36%Fix available

    Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042

    Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.

    diff drupal/diffPHP
    • Update to 1.8.0
    • Update to 2.0.0-beta3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2024-13275

    Medium · CVSS 5.3EPSS 0.38%Fix available

    Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039

    Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Drupal Security Kit allows HTTP DoS.This issue affects Security Kit: from 0.0.0 before 2.0.3.

    security kit drupal/seckitPHP
    • Update to 2.0.3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2024-13274

    Medium · CVSS 5.3EPSS 0.38%Fix available

    Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038

    Improper Control of Interaction Frequency vulnerability in Drupal Open Social allows Functionality Misuse.This issue affects Open Social: from 0.0.0 before 12.3.8, from 12.4.0 before 12.4.5.

    open social goalgorilla/open_social goalgorilla/open_social goalgorilla/open_socialPHP
    • Update to 12.3.8
    • Update to 12.4.5
    • Update to 13.0.0-alpha11
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  7. CVE-2024-13272

    Medium · CVSS 6.3EPSS 0.25%Fix available

    Paragraphs table - Critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-036

    Insufficient Granularity of Access Control vulnerability in Drupal Paragraphs table allows Content Spoofing.This issue affects Paragraphs table: from 0.0.0 before 1.23.0, from 2.0.0 before 2.0.2.

    paragraphs table drupal/paragraphs_tablePHP
    • Update to 1.23.0
    • Update to 2.0.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  12. CVE-2024-13265

    High · CVSS 7.5EPSS 0.57%Fix available

    Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno Learning path allows PHP Local File Inclusion.This issue affects Opigno Learning path: from 0.0.0 before 3.1.2.

    opigno learning path drupal/opigno_learning_pathPHP
    • Update to 3.1.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  13. CVE-2024-13264

    Critical · CVSS 9.8EPSS 0.47%Fix available

    Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno module allows PHP Local File Inclusion.This issue affects Opigno module: from 0.0.0 before 3.1.2.

    opigno module drupal/opigno_modulePHP
    • Update to 3.1.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2024-13263

    Medium · CVSS 5.5EPSS 0.27%Fix available

    Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027

    Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') vulnerability in Drupal Opigno group manager allows PHP Local File Inclusion.This issue affects Opigno group manager: from 0.0.0 before 3.1.1.

    opigno group manager drupal/opigno_group_managerPHP
    • Update to 3.1.1
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2024-13262

    Medium · CVSS 4.8EPSS 0.28%Fix available

    View Password - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-026

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal View Password allows Cross-Site Scripting (XSS).This issue affects View Password: from 0.0.0 before 6.0.4.

    view password drupal/view_passwordPHP
    • Update to 6.0.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2024-13261

    Low · CVSS 3.5EPSS 0.15%Fix available

    Acquia DAM - Moderately critical - Cross Site Request Forgery, Denial of Service - SA-CONTRIB-2024-025

    Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia DAM allows Cross Site Request Forgery.This issue affects Acquia DAM: from 0.0.0 before 1.0.13, from 1.1.0 before 1.1.0-beta3.

    acquia dam drupal/acquia_damPHP
    • Update to 1.0.13
    • Update to 1.1.0-beta3
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2024-13258

    Critical · CVSS 9.8EPSS 0.66%Fix available

    Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022

    Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.

    drupal rest & json api authentication drupal/rest_api_authenticationPHP
    • Update to 2.0.13
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →