Skip to content
OpenAdvisories

Package · Alpine

php83

50 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.5
    CVE-2026-91765

    SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

    cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the …

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 8.1
    CVE-2026-17543 Public exploit

    SQL injection in ext-pgsql via E'...' backslash breakout

    Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 7.3
    CVE-2026-6735

    XSS within PHP-FPM status endpoint

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the …

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 8.2
    CVE-2025-14180

    NULL Pointer Dereference in PDO quoting

    In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared sta…

    PHP Group PHP php8.1 php8.2 Debian Ubuntu Alpine
  • High 7.5
    CVE-2024-8927

    cgi.force_redirect configuration is bypassable due to the environment variable collision

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be control…

    PHP Group PHP php5 php7.0 Debian Ubuntu Alpine
  • High 8.1
    CVE-2024-8926

    PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the…

    PHP Group PHP php8.2 php83 Debian Alpine
  • High 7.7
    CVE-2024-5585 EPSS 29%

    Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping,…

    PHP Group PHP php83 php82 Alpine
  • High 7.5
    CVE-2024-2757

    PHP mb_encode_mimeheader runs endlessly for some inputs

    In PHP 8.3.* before 8.3.5, function mb_encode_mimeheader() runs endlessly for some inputs that contain long strings of non-space characters followed by a space. This could lead to a potential DoS attack if a hostile user sends data to an application that uses…

    PHP Group PHP php83 php8.3 Ubuntu Alpine