CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-0662 – DoS vulnerability when parsing multipart request body
https://notcve.org/view.php?id=CVE-2023-0662
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessive number of log entries. This can cause denial of service on the affected server by exhausting CPU resources or disk space. A vulnerability was found in PHP. This security flaw occurs when the request body parsing in PHP allows any unauthenticated attacker to consume a large amount of CPU time and trigger excessive logging. A large amount of CPU time required for processing requests can block all available worker processes and significantly delay or slow the processing of legitimate user requests. • https://github.com/php/php-src/security/advisories/GHSA-54hq-v5wp-fqgv https://security.netapp.com/advisory/ntap-20230517-0001 https://access.redhat.com/security/cve/CVE-2023-0662 https://bugzilla.redhat.com/show_bug.cgi?id=2170761 • CWE-400: Uncontrolled Resource Consumption CWE-779: Logging of Excessive Data •
CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 1CVE-2023-0567 – password_verify() always returns true for some invalid hashes
https://notcve.org/view.php?id=CVE-2023-0567
In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid. A vulnerability was found in PHP. This security flaw occurs when malformatted BCrypt hashes that include a $ within their salt part trigger a buffer overread and may erroneously validate any password as valid. • https://bugs.php.net/bug.php?id=81744 https://github.com/php/php-src/security/advisories/GHSA-7fj2-8x79-rjf4 https://access.redhat.com/security/cve/CVE-2023-0567 https://bugzilla.redhat.com/show_bug.cgi?id=2170771 • CWE-328: Use of Weak Hash CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-36503
https://notcve.org/view.php?id=CVE-2021-36503
SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file. • https://github.com/Fanli2012/native-php-cms/issues/3 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-23879 – WordPress PHP Execution Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-23879
Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions. The PHP Execution plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.0. This is due to missing nonce validation in the ~/php_execution_admin.php function. This makes it possible for unauthenticated attackers to enable the ability for users with low-level privileged users to trigger PHP, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/php-execution-plugin/wordpress-php-execution-plugin-1-0-0-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-10064 – VictorFerraresi pokemon-database-php sql injection
https://notcve.org/view.php?id=CVE-2015-10064
A vulnerability was found in VictorFerraresi pokemon-database-php. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named dd0e1e6cdf648d6a3deff441f515bcb1d7573d68. • https://github.com/VictorFerraresi/pokemon-database-php/commit/dd0e1e6cdf648d6a3deff441f515bcb1d7573d68 https://vuldb.com/?ctiid.218455 https://vuldb.com/?id.218455 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •