Skip to content
OpenAdvisories

Package · Wolfi

php-8.2

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.4
    CVE-2025-14179

    SQL injection in pdo_firebird via NUL bytes in quoted strings

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL b…

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Wolfi
  • High 7.3
    CVE-2026-6735 Public exploit

    XSS within PHP-FPM status endpoint

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the …

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.7
    CVE-2024-5585 EPSS 29%

    Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping,…

    PHP Group PHP php php83 Azure Linux Alpine Wolfi