The NCSC-NL software inventory
All 674 rows of NCSC-NL's php2shell inventory at commit cca173c64ec5, as parsed into the vault. Status is NCSC-NL's per CVE; the note is the first line of theirs. Licence EUPL-1.2. This page is generated from the parsed file and changes only when the vault does. NCSC-NL NCSC-NL
| Supplier | Product | Version | 109618 | 109619 | NCSC-NL note | Links |
|---|---|---|---|---|---|---|
| aaPanel | aaPanel PHP Project hosting and CLI selection | aaPanel PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 | Fix | Fix | CVE assessment: aaPanel staff announces patched PHP 8.2-8.5 builds in the App Store. Refresh the app list and update every installed branch; this does not confirm fixes for PHP 8.1 or earlier. | aapanel.com aapanel.com |
| Acquia | Acquia Cloud Platform PHP hosting | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | docs.acquia.com | |
| Adiscon / LogAnalyzer project | Adiscon LogAnalyzer PHP web application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| Adobe | Adobe Commerce | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | experienceleague.adobe.com experienceleague.adobe.com | |
| Adyen | Adyen API PHP library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| AfterLogic | AfterLogic WebMail Lite PHP | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | afterlogic.com | |
| Aimeos project | Aimeos Laravel package | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Aimeos project | Aimeos TYPO3 extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | aimeos.org | |
| Akaunting | Akaunting self-hosted application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| Akeneo | Akeneo PIM Community Edition | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | github.com | |
| Alpine Linux package maintainers | Alpine Linux v3.22 php84 package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pkgs.alpinelinux.org | |
| Amazon Web Services | AWS Elastic Beanstalk PHP platform | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | docs.aws.amazon.com | |
| Amazon Web Services | AWS SDK for PHP v3 | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org docs.aws.amazon.com | |
| Amazon Web Services; third-party/customer PHP runtime publisher | AWS Lambda customer PHP custom-runtime option | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | bref.sh docs.aws.amazon.com | |
| AMPHP project | AMP asynchronous PHP framework | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Antagonist | Antagonist DirectAdmin PHP hosting selector | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | help.antagonist.nl | |
| Apache Friends | XAMPP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | apachefriends.org apachefriends.org | |
| APCu / PHP extension maintainers | APCu native PHP user-cache extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net | |
| API Platform project | API Platform Core | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org | |
| Arch Linux package maintainers | Arch Linux Extra PHP package | 8.5.12-1 | Fix | Fix | CVE assessment: Fixed in Arch Linux php 8.5.12-1 | archlinux.org archlinux.org |
| Arch Linux package maintainers | Arch Linux Extra php-legacy package | 8.3.36-1 | Fix | Fix | CVE assessment: Fixed in Arch Linux Extra php-legacy 8.3.36-1 | archlinux.org archlinux.org |
| Artefactual Systems / AtoM project | AtoM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | accesstomemory.org | |
| Ascensio System SIA / ONLYOFFICE | ONLYOFFICE integration for Nextcloud | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com github.com | |
| Auth0 | Auth0 PHP SDK | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| Automattic / WordPress.com | WordPress.com plugin-enabled PHP hosting environment | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | wordpress.com | |
| AWS SDK Common Runtime team | AWS Common Runtime native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net github.com | |
| AWS SDK Common Runtime team | AWS Common Runtime PHP userland binding package | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Backdrop CMS project | Backdrop CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.backdropcms.org backdropcms.org | |
| bbPress community / WordPress project | bbPress | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | wordpress.org | |
| Behat project | Behat behavior-driven test framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| Belnet | Belnet FileSender research/education service | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | belnet.be docs.filesender.org | |
| Ben Ramsey / Ramsey project | Ramsey UUID | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Beyond Code in partnership with Laravel | Laravel Herd managed native PHP environment | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | herd.laravel.com herd.laravel.com | |
| Blackfire / Platform.sh SAS doing business as Upsun | Blackfire deterministic PHP Probe native extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.blackfire.io docs.blackfire.io docs.blackfire.io | |
| Blackfire / Platform.sh SAS doing business as Upsun | Blackfire PHP SDK client library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org docs.blackfire.io | |
| Bolt CMS project | Bolt CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.boltcms.io | |
| BookStack project | BookStack | Runtime: PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12, or vendor-confirmed Ubuntu backports | Fix | Fix | CVE assessment: BookStack confirms runtime fixes for its Ubuntu, Debian and Arch installations. Docker images, Home Assistant and RHEL-family packages were still awaiting fixes in the reviewed bulletin; updating BookStac | bookstackapp.com bookstackapp.com |
| Box / Humbug project | Box PHAR build and packaging tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| BoxBilling project | BoxBilling | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Bref project | Bref PHP Lambda runtime layers | Bref 3: php-85:21, php-84:24, php-83:24, php-82:26; Bref 2 layers 2.3.45: php-84[-fpm]:43, php-83[-fpm]:71, php-82[-fpm]:115 | Fix | Fix | CVE assessment: Patched Bref 3 and Bref 2 Lambda layers published in all regions; Bref 1 excluded | bref.sh github.com bref.sh |
| Bref project | Bref PHP serverless application adapter | bref/bref 3.0.14 or 2.4.22 selecting patched runtime layers | Fix | Fix | CVE assessment: Bref identifies bref/bref 3.0.14 and 2.4.22 as selecting the patched layers. Update the adapter and redeploy; this fixes its selected PHP runtime, not an independent flaw in the adapter's PHP code. | packagist.org github.com bref.sh |
| Bref project | Bref v2 PHP Docker images | Bref v2 Docker tags 2 and 2.3.45: PHP 8.2.35 / 8.3.36 / 8.4.27 | Fix | Fix | CVE assessment: Fixed Bref v2 PHP Docker images published under tags 2 and 2.3.45; older cached images remain unpatched | bref.sh github.com bref.sh |
| BuddyPress community / WordPress project | BuddyPress | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | buddypress.trac.wordpress.org wordpress.org | |
| bunq | bunq PHP API SDK | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| Cachet project | Cachet | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | github.com api.github.com | |
| CakePHP project | CakePHP framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org | |
| Canonical / Ubuntu package maintainers | Ubuntu Bionic php7.2-fpm binary package | 7.2.24-0ubuntu0.18.04.17+esm14 | Fix | Fix | CVE assessment: Fixed in Ubuntu Bionic php7.2-fpm 7.2.24-0ubuntu0.18.04.17+esm14 | ubuntu.com |
| Canonical / Ubuntu package maintainers | Ubuntu Focal php7.4-fpm binary package | 7.4.3-4ubuntu2.29+esm5 | Fix | Fix | CVE assessment: Fixed in Ubuntu Focal php7.4-fpm 7.4.3-4ubuntu2.29+esm5 | ubuntu.com |
| Canonical / Ubuntu package maintainers | Ubuntu Jammy php8.1-fpm binary package | 8.1.2-1ubuntu2.28 | Fix | Fix | CVE assessment: Fixed in Ubuntu Jammy php8.1-fpm 8.1.2-1ubuntu2.28 | ubuntu.com |
| Canonical / Ubuntu package maintainers | Ubuntu Noble php8.3-fpm binary package | 8.3.6-0ubuntu0.24.04.13 | Fix | Fix | CVE assessment: Fixed in Ubuntu Noble php8.3-fpm 8.3.6-0ubuntu0.24.04.13 | packages.ubuntu.com ubuntu.com |
| Canonical / Ubuntu package maintainers | Ubuntu optional PHP package and SAPI family | Jammy 8.1.2-1ubuntu2.28; Noble 8.3.6-0ubuntu0.24.04.13; Resolute 8.5.4-0ubuntu1.5; Stonking 8.5.9-0ubuntu2.1 | Fix | Fix | CVE assessment: USN-8948-1 fixes both CVEs in Ubuntu's Apache-module, CGI, CLI and FPM packages for Jammy, Noble, Resolute and Stonking. This family row supplements the separately inventoried FPM release rows. | ubuntu.com packages.ubuntu.com ubuntu.com |
| Canonical / Ubuntu package maintainers | Ubuntu Resolute php8.5-fpm binary package | 8.5.4-0ubuntu1.5 | Fix | Fix | CVE assessment: Fixed in Ubuntu Resolute php8.5-fpm 8.5.4-0ubuntu1.5 | ubuntu.com |
| Canonical / Ubuntu package maintainers | Ubuntu Stonking php8.5-fpm binary package | 8.5.9-0ubuntu2.1 | Fix | Fix | CVE assessment: Fixed in Ubuntu Stonking php8.5-fpm 8.5.9-0ubuntu2.1 | ubuntu.com |
| Canonical / Ubuntu package maintainers | Ubuntu Trusty php5-fpm binary package | 5.5.9+dfsg-1ubuntu4.29+esm18 | Fix | Fix | CVE assessment: Fixed in Ubuntu Trusty php5-fpm 5.5.9+dfsg-1ubuntu4.29+esm18 | ubuntu.com |
| Canonical / Ubuntu package maintainers | Ubuntu Xenial php7.0-fpm binary package | 7.0.33-0ubuntu0.16.04.16+esm22 | Fix | Fix | CVE assessment: Fixed in Ubuntu Xenial php7.0-fpm 7.0.33-0ubuntu0.16.04.16+esm22 | ubuntu.com |
| CaptainHook / Sebastian Feldmann and contributors | CaptainHook PHP Git-hook manager | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| CarbonPHP project | Carbon date/time library | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Catalyst IT / Mahara project | Mahara | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | manual.mahara.org mahara.org | |
| Centreon | Centreon Web and central-server PHP interface | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.centreon.com github.com | |
| Chamilo Association / Chamilo project | Chamilo | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.chamilo.org | |
| Checkmk GmbH | Checkmk Appliance | 1.7.25 | Fix | Fix | CVE assessment: Fixed in Checkmk Appliance 1.7.25 via bundled PHP 8.2.35 package update | checkmk.com download.checkmk.com php.net |
| CIRCL, Luxembourg | CIRCL-operated MISP threat-sharing service | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | circl.lu circl.lu | |
| CircleCI | CircleCI cimg/php CI runtime image family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | circleci.com github.com | |
| Citrix / NetScaler | NetScaler ADC | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | citrix.com prod-docs.netscaler.com | |
| CiviCRM project | CiviCRM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org docs.civicrm.org | |
| ClassicPress project | ClassicPress | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | classicpress.net docs.classicpress.net | |
| Clever Cloud fork of Caucho Technology Quercus | Quercus CleverCloud development branch | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | github.com | |
| Clientexec | Clientexec | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | docs.clientexec.com | |
| Cloudflare | Cloudflare Pages v1 legacy PHP build image | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | developers.cloudflare.com | |
| CloudLinux | CloudLinux legacy ea-PHP extended-support packages | Vulnerable | Vulnerable | CVE assessment: Affected package streams: CloudLinux ea-php and broad TuxCare PHP ELS family; scoped fixed ELS rows are recorded separately | docs.cloudlinux.com cloudlinux.zendesk.com cloudlinux.statuspage.io | |
| CloudLinux / TuxCare | CloudLinux Alt-PHP / PHP Selector runtime family | Vulnerable | Vulnerable | CVE assessment: Affected family: CloudLinux Alt-PHP; scoped fixed alt-php74 and alt-php80 platform rows are recorded separately | docs.cloudlinux.com cloudlinux.statuspage.io cloudlinux.zendesk.com | |
| CloudLinux / TuxCare | CloudLinux Alt-PHP 7.4 fixed package set | Fix | Fix | CVE assessment: Fixed builds released for CloudLinux alt-php74 on EL6, EL7, EL8, EL10, Debian 10, Debian 11, Ubuntu 16.04, Ubuntu 18.04, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04 | cloudlinux.statuspage.io | |
| CloudLinux / TuxCare | CloudLinux Alt-PHP 8.0 package for Alpine Linux 3.23 | Fix | Fix | CVE assessment: Fixed build released for CloudLinux alt-php80 on Alpine Linux 3.23 | cloudlinux.statuspage.io | |
| Code LTS / William Desportes and contributors | Doctum PHP API documentation generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| Codeception / Michael Bodnarchuk and contributors | Codeception PHP test framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| CodeIgniter Foundation | CodeIgniter 4 framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org | |
| Combodo | iTop | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Composer / Packagist project | Packagist.org open-source web application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| Composer / Satis maintainers | Satis Composer repository generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| Composer / Satis maintainers | Satis official PHP container build recipe | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Composer project | Composer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | getcomposer.org getcomposer.org | |
| Composer project / Docker Official Images | Composer default Docker runtime image | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com github.com github.com | |
| Concrete CMS / PortlandLabs | Concrete CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | documentation.concretecms.org | |
| Contao project | Contao CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.contao.org | |
| Contao project | Contao Manager | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.contao.org | |
| Coolify | Coolify | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | github.com api.github.com | |
| Corporation for Digital Scholarship / Omeka project | Omeka Classic | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | omeka.org | |
| Corporation for Digital Scholarship / Omeka project | Omeka S | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | omeka.org | |
| Couchbase, Inc. | Couchbase native PHP SDK extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net docs.couchbase.com docs.couchbase.com | |
| Couchbase, Inc. | Couchbase PHP Composer SDK package | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org docs.couchbase.com | |
| Couchbase, Inc. | Couchbase PHP OpenTelemetry integration | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown | packagist.org | |
| Craft CMS / Pixel & Tonic | Craft CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | craftcms.com | |
| Crater Invoice | Crater | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | github.com api.github.com | |
| CS-Cart | CS-Cart and Multi-Vendor | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.cs-cart.com | |
| CyberPanel project | CyberPanel hosted PHP / LSPHP options | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | github.com github.com | |
| daloRADIUS project | daloRADIUS official Docker distribution recipe | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| daloRADIUS project | daloRADIUS PHP web management application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Dan Phillimore / Uniter project | Uniter PHP-to-JavaScript runtime stack | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | phptojs.com | |
| Datadog / Blackfire integration | Blackfire PHP continuous-profiler integration using Datadog profiling extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.blackfire.io github.com | |
| DDEV project | DDEV PHP webserver development container | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.ddev.com | |
| Debian PHP Maintainers | Debian trixie PHP 8.4 FPM package | 8.4.27-1~deb13u1 | Fix | Fix | CVE assessment: Fixed in Debian trixie php8.4 8.4.27-1~deb13u1 | packages.debian.org lists.debian.org |
| Deployer / Anton Medvedev and contributors | Deployer PHP deployment automation | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| DEVSENSE / Phalanger project | Phalanger PHP 5.4 compiler for .NET/Mono | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | github.com | |
| Docker Community / Docker Official Images, not WordPress upstream image ownership | WordPress Docker Official Image distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com github.com | |
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP Apache/mod_php image variant | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | github.com github.com github.com | |
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP CLI image variant | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | github.com github.com github.com | |
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP FPM image variant | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | github.com github.com github.com | |
| Docker Official Images / docker-library PHP maintainers | Docker Official PHP ZTS image variant | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | github.com github.com github.com | |
| Docker Official Images maintainers | Docker Official Image: php | Fix | Fix | CVE assessment: Fixed in official Docker PHP image source definitions and official-images metadata for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12; deployed tags and digests must be verified | github.com hub.docker.com github.com | |
| Doctrine project | Doctrine DBAL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org doctrine-project.org | |
| Doctrine project | Doctrine ORM | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| DokuWiki project | DokuWiki official Docker distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com github.com | |
| DokuWiki project / splitbrain | DokuWiki | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Dolibarr project | Dolibarr ERP CRM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | wiki.dolibarr.org github.com | |
| Drupal Commerce / Centarro | Drupal Commerce | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | drupal.org | |
| Drupal project | Drupal | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | drupal.org drupal.org drupal.org | |
| Drush project | Drush Drupal administration CLI | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| EasyPHP project | EasyPHP PHP Devserver Windows bundle | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | easyphp.org | |
| EC-CUBE project | EC-CUBE | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org github.com | |
| EGroupware GmbH / EGroupware project | EGroupware | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org github.com | |
| Elastic | Elasticsearch official PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org elastic.co | |
| Endor; linked by Apache Friends | Endor browser LAMP sandbox / XAMPP for Browsers | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | endor.dev apachefriends.org | |
| Enhancesoft / osTicket project | osTicket | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.osticket.com | |
| EspoCRM project | EspoCRM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.espocrm.com | |
| European Commission | EU Academy Moodle service (2023 evidence) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | interoperable-europe.ec.europa.eu moodledev.io | |
| European Commission / OpenEuropa contributors | OpenEuropa Authentication Drupal module | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org github.com | |
| European Commission / OpenEuropa contributors | OpenEuropa Content Drupal module | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| European Commission / OpenEuropa contributors | OpenEuropa Task Runner | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| ExpressionEngine project | ExpressionEngine | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.expressionengine.com | |
| F5 | BIG-IP APM PHP page templates | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | techdocs.f5.com techdocs.f5.com | |
| F5 | BIG-IP TMOS platform PHP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | cdn.f5.com my.f5.com | |
| Facebook / HHVM project | HHVM 3.30 PHP-compatible legacy line | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | hhvm.com hhvm.com hhvm.com | |
| Facebook / HipHop project | HipHop for PHP compiler (HPHPc) | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | engineering.fb.com | |
| Fedora Project PHP maintainers | Fedora PHP distribution package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packages.fedoraproject.org | |
| Feng Office | Feng Office Community Edition | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| FileCloud | FileCloud Server PHP installation and maintenance | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.filecloud.com | |
| FileGator project | FileGator | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.filegator.io | |
| FileRun | FileRun | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.filerun.com | |
| FileSender project | FileSender | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.filesender.org filesender.org | |
| Firefly III project | Firefly III | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | github.com api.github.com | |
| Flarum project / Flarum Foundation | Flarum | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.flarum.org docs.flarum.org | |
| Fly.io; customer runtime-image publisher | Fly.io customer Laravel/PHP Machines deployment | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | fly.io | |
| Forma LMS project | Forma LMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Fortinet | FortiADC | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | fortinetweb.s3.amazonaws.com docs2.fortinet.com | |
| FOSSBilling project | FOSSBilling | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.fossbilling.org github.com | |
| FrankenPHP | FrankenPHP static builds | Vulnerable | Vulnerable | CVE assessment: Affected: FrankenPHP web-serving builds embedding affected PHP versions; fixed artifact release not yet confirmed | frankenphp.dev php.net github.com | |
| FreeBSD Project / ports maintainers | FreeBSD PHP port and mod_php package integration | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | lists.freebsd.org docs.freebsd.org | |
| FreeScout project | FreeScout | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com github.com | |
| FreshRSS project | FreshRSS | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | freshrss.github.io | |
| FrontAccounting project | FrontAccounting | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Froxlor Team | Froxlor control panel PHP branches | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com docs.froxlor.org | |
| FusionDirectory | FusionDirectory | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | fusiondirectory-user-manual.readthedocs.io | |
| FusionDirectory | FusionDirectory Orchestrator | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | fusiondirectory-user-manual.readthedocs.io | |
| FusionPBX project | FusionPBX PHP management application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Gentoo PHP maintainers | Gentoo dev-lang/php runtime package family | dev-lang/php 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or later within each respective slot | Fix | Fix | CVE assessment: Gentoo GLSA 202610-02 confirms both CVEs and fixed dev-lang/php versions in the 8.2, 8.3, 8.4 and 8.5 slots on all architectures. | packages.gentoo.org security.gentoo.org |
| GLPI / Teclib | GLPI | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | glpi-install.readthedocs.io github.com github.com | |
| Google APIs Client Library for PHP | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | ||
| Google Auth Library for PHP | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | ||
| Google Cloud Firestore PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | ||
| Google Cloud Storage PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | ||
| Google / googleapis contributors | Google Cloud PHP client monolith | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| Google / Protocol Buffers project | Protocol Buffers native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net | |
| Google / Protocol Buffers project | Protocol Buffers PHP userland runtime | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Google Cloud | Google App Engine Flexible PHP runtime | App Engine Flexible PHP runtimes not redeployed onto patched supported images | Vulnerable | Vulnerable | CVE assessment: Google requires redeployment of App Engine Flexible PHP applications; existing deployments are not automatically patched. Supported base-image updates are rolling out. Custom runtimes require rebuilding w | docs.cloud.google.com cloud.google.com |
| Google Cloud | Google App Engine Standard PHP runtime | PHP 8.2+ supported runtimes | Fix | Fix | CVE assessment: Google App Engine Standard supported PHP 8.2+ runtimes are patched automatically | docs.cloud.google.com cloud.google.com |
| Google Cloud; customer image publisher | Google Cloud Run customer PHP container option | Cloud Run customer containers with unpatched PHP on their respective branches | Vulnerable | Vulnerable | CVE assessment: Google requires customer-built Cloud Run PHP containers to be rebuilt and redeployed with patched PHP. The platform's own non-vulnerability statement does not make unpatched customer containers safe. | docs.cloud.google.com cloud.google.com |
| Grav project | Grav CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | learn.getgrav.org learn.getgrav.org | |
| Grokability / Snipe-IT project | Snipe-IT | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | snipe-it.readme.io | |
| grommunio GmbH | grommunio Web | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| gRPC project | gRPC native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net grpc.io | |
| gRPC project | gRPC PHP Composer support library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org grpc.io grpc.io | |
| Guzzle project | Guzzle HTTP client | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Heroku / Salesforce | Heroku PHP buildpack and application runtime | Heroku PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; rebuilt 8.1.34 on Heroku-22 | Fix | Fix | CVE assessment: Heroku publishes fixed supported PHP runtimes and requires app redeployment. Its rebuilt PHP 8.1.34 carries the emergency backport but remains end-of-life; upgrading to a supported branch is recommended. | devcenter.heroku.com devcenter.heroku.com |
| Hestia Control Panel project | HestiaCP hestia-php internal runtime | Unpatched HestiaCP bundled hestia-php runtime; fix still being built | Vulnerable | Vulnerable | CVE assessment: HestiaCP's maintainer explicitly confirms its bundled hestia-php remains vulnerable while a fix is prepared. This is distinct from patched distribution PHP serving hosted websites; INI changes are not a c | github.com hestiacp.com hestiacp.com |
| Hestia Control Panel project | HestiaCP hosted-site PHP-FPM / MultiPHP option | HestiaCP hosted-site PHP using patched distribution/Sury packages announced 2026-10-21 | Fix | Fix | CVE assessment: HestiaCP's maintainer confirms patched PHP packages are available for hosted websites. Operators must install them and restart hosted PHP; this does not fix the separately bundled hestia-php panel runtime | hestiacp.com github.com |
| HikaShop project | HikaShop Joomla component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | hikashop.com | |
| HippyVM contributors | HippyVM RPython PHP implementation | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | github.com | |
| Homebrew maintainers | Homebrew PHP formula and bottles | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | formulae.brew.sh | |
| Horde Project | Horde Groupware Webmail Edition 5 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| HostBill / HostBillApp | HostBill | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | hostbill.atlassian.net | |
| HumHub | HumHub | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | docs.humhub.org | |
| Ibexa | Ibexa DXP | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | doc.ibexa.co | |
| Icinga GmbH | Icinga Certificate Monitoring | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | icinga.com icinga.com | |
| Icinga GmbH | Icinga DB Web | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | icinga.com | |
| Icinga GmbH | Icinga Director | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | icinga.com | |
| Icinga GmbH | Icinga PDF Export | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | icinga.com | |
| Icinga GmbH | Icinga Reporting | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | icinga.com icinga.com | |
| Icinga GmbH | Icinga Web | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | icinga.com icinga.com | |
| igbinary project | igbinary native PHP serializer extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net | |
| ILIAS Society / ILIAS project | ILIAS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| Imagick project | Imagick native PHP image extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net | |
| iNextrix / ASTPP | ASTPP v7 PHP billing and management application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | astppbilling.org | |
| Infection project | Infection PHP mutation-testing tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| Invision Community / Invision Power Services | Invision Community Classic | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | invisioncommunity.com | |
| Invoice Ninja | Invoice Ninja self-hosted server | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com invoiceninja.org github.com | |
| InvoicePlane project | InvoicePlane | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| IONOS | IONOS webhosting PHP and CLI options | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | ionos.com ionos.com | |
| ISPConfig project | ISPConfig 3 control panel UI and scripts | ISPConfig 3 installations using unpatched PHP; bulletin covers 3.2/3.3 web servers | Vulnerable | Vulnerable | CVE assessment: ISPConfig explicitly includes its control panel among applications affected through unpatched PHP. Its multipart guard is a temporary mitigation, not a runtime fix. | ispconfig.org ispconfig.org |
| Issabel | Issabel 5 PHP communications management | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | issabel.com | |
| Jakub Vrana / Adminer project | Adminer | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | adminer.org | |
| JBMC Software / DirectAdmin | DirectAdmin CustomBuild hosted PHP | CustomBuild PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12; vendor-patched PHP 7.4 / 8.0 / 8.1 | Fix | Fix | CVE assessment: DirectAdmin staff confirms patched CustomBuild releases on current/stable channels. Rebuilding hosted PHP is required; legacy 5.6-7.3 patches were pending and PHP 8.1 compilation problems were acknowledge | docs.directadmin.com docs.directadmin.com forum.directadmin.com |
| JetBrains | PhpStorm external PHP interpreter integration | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown | jetbrains.com | |
| Joomla project | Joomla 6.x | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | manual.joomla.org | |
| Jordi Boggiano / Monolog contributors | Monolog | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| JPHP Group | JPHP JVM compiler and runtime | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | github.com | |
| Juniper Networks | Junos OS J-Web (EX/SRX scope) | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com supportportal.juniper.net | |
| Kanboard project | Kanboard | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.kanboard.org | |
| Kevin Papst / Kimai project | Kimai | Kimai 2.70.1 rebuilt supported Docker image tags | Fix | Fix | CVE assessment: Kimai's 2.70.1 release triggers patched PHP Docker rebuilds; the maintainer subsequently confirms that supported tags have been pushed. Self-hosted non-container installations still need their own PHP run | packagist.org github.com github.com |
| Kinsta | Kinsta managed WordPress PHP hosting | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | kinsta.com | |
| Kirby CMS project | Kirby CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | getkirby.com | |
| Klemen Stirn / Hesk | Hesk Free self-hosted helpdesk | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | hesk.com | |
| Kopano / Kopano-dev | Kopano WebApp | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Krayin | Krayin CRM | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | github.com api.github.com | |
| Ladybird Web Solution / Faveo | Faveo Helpdesk Community Edition | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.faveohelpdesk.com docs.faveohelpdesk.com | |
| Laminas Project / Linux Foundation | Laminas MVC | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org docs.laminas.dev | |
| Laminas Project / Mezzio | Mezzio | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org docs.laminas.dev | |
| Lando project | Lando PHP service plugin images | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.lando.dev | |
| Laragon project | Laragon Full Windows development bundle | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | laragon.org | |
| Laravel | Laravel 13 framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | laravel.com laravel.com | |
| Laravel | Laravel Cloud PHP runtime option | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | laravel.com laravel.com | |
| Laravel | Laravel Vapor core PHP invocation package | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Laravel | Laravel Vapor PHP Docker base image family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.vapor.build | |
| Laravel; AWS infrastructure | Laravel Vapor PHP serverless hosting configuration | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | docs.vapor.build | |
| LDAP Account Manager project | LDAP Account Manager | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | ldap-account-manager.org | |
| Leantime project | Leantime | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| LibreNMS project | LibreNMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.librenms.org github.com | |
| libsmbclient-php project | SMBClient native PHP Samba binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net | |
| libvirt-php contributors / Unraid distribution | Unraid libvirt-php management binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.unraid.net docs.unraid.net | |
| Lime Technology / Unraid | Unraid PHP management runtime distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.unraid.net docs.unraid.net | |
| LimeSurvey GmbH / LimeSurvey project | LimeSurvey Community Edition | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | limesurvey.org limesurvey.org | |
| LiveCodes project | LiveCodes PHP (Uniter) browser mode | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | livecodes.io | |
| LiveCodes project | LiveCodes PHP (Wasm) browser mode | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | livecodes.io | |
| Lunar project | Lunar administration panel | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Lunar project | Lunar commerce core | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| m0n0wall project | m0n0wall legacy PHP-CGI management appliance | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | m0n0.ch m0n0.ch | |
| Mage-OS project | Mage-OS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | mage-os.org | |
| Magento / Adobe | Magento Open Source | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | experienceleague.adobe.com experienceleague.adobe.com | |
| MailWatch project | MailWatch for MailScanner | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| MAMP GmbH | MAMP local server environment | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | mamp.info mamp.info | |
| MantisBT project | MantisBT | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Matomo | Matomo On-Premise | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | matomo.org github.com | |
| Matomo / InnoCraft | Matomo Analytics for WordPress | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | wordpress.org | |
| Matomo team | Matomo PHP tracking client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| Mautic project | Mautic | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.mautic.org github.com | |
| MediaWiki project | MediaWiki | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | mediawiki.org | |
| MessageBird | MessageBird PHP REST API client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| Metaways / tine project | tine groupware | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.tine-groupware.de | |
| Microsoft | Azure App Service PHP on Linux | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | learn.microsoft.com | |
| Microsoft Azure Storage | Microsoft Azure Storage PHP blob client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | packagist.org github.com | |
| Microsoft Azure Storage | Microsoft Azure Storage PHP common client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | packagist.org github.com | |
| Microsoft Azure Storage | Microsoft Azure Storage PHP file client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | packagist.org github.com | |
| Microsoft Azure Storage | Microsoft Azure Storage PHP queue client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | packagist.org github.com | |
| Microsoft Azure Storage | Microsoft Azure Storage PHP table client package (retired) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | packagist.org github.com | |
| Microsoft Graph Client Tooling | Microsoft Graph PHP SDK | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| MISP project / CIRCL | MISP 2.5 core PHP server | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | circl.lu github.com | |
| Mockery project | Mockery PHP test-double framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| MODX project | MODX Revolution | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.modx.com | |
| Mollie | Mollie Payments for WooCommerce | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | wordpress.org | |
| Mollie B.V. | Mollie API PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| MongoDB PHP driver team | MongoDB native PHP driver extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net php.net | |
| MongoDB PHP driver team | MongoDB PHP userland library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| Monica project | Monica | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | github.com api.github.com | |
| Montala / ResourceSpace | ResourceSpace | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | resourcespace.com | |
| Moodle project | Moodle | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | moodledev.io docs.moodle.org download.moodle.org | |
| Moodle project / complete-installer packagers | Moodle Windows complete installer family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | download.moodle.org | |
| Moodle project / Ralf Krause | Moodle4Mac complete installer family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | download.moodle.org docs.moodle.org | |
| msgpack-php project | MessagePack native PHP serialization extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net | |
| MyBB Group | MyBB | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.mybb.com | |
| MyBB Group | MyBB Merge System | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.mybb.com | |
| N-able | Mail Assure / Spam Experts | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | n-able.com | |
| N-able | N-sight | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | n-able.com | |
| N-able | Passportal | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | n-able.com | |
| N-able | Take Control Session routing | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | n-able.com | |
| Nagios Enterprises | Nagios Fusion web component subsystem | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | assets.nagios.com | |
| Nagios Enterprises | Nagios XI web configuration-wizard subsystem | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | assets.nagios.com | |
| Neos project | Neos CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.neos.io | |
| Netgate / pfSense | pfSense management components | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | netgate.com docs.netgate.com docs.netgate.com | |
| Netlify | Netlify PHP build environment and Composer integration | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | docs.netlify.com | |
| Nette community | Nette Application | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette Assets | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette Bootstrap | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette Caching | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette Command Line | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette Database | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette DI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette Forms | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette HTTP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette Mail | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette PHP Generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| Nette community | Nette RobotLoader | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette SafeStream | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette Security | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community | Nette Utils | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community / Latte | Latte template engine | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Nette community / Tracy | Tracy debugger | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| Nette Foundation / Nette community | Nette framework metapackage | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org | |
| Nextcloud | Nextcloud Office integration app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Nextcloud | Nextcloud Server | Vulnerable | Vulnerable | CVE assessment: Affected: Nextcloud deployments using affected PHP versions; apply a vendor-appropriate fixed PHP runtime or rebuilt image | github.com docs.nextcloud.com docs.nextcloud.com | |
| Nextcloud | Nextcloud Talk server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Nextcloud Calendar project | Nextcloud Calendar server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | lists.freebsd.org github.com github.com | |
| Nextcloud Collectives project | Nextcloud Collectives server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Nextcloud Contacts project | Nextcloud Contacts server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Nextcloud Deck project | Nextcloud Deck | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com github.com | |
| Nextcloud Docker community volunteers / Docker Official Images | Nextcloud community Docker image distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Nextcloud GmbH / Nextcloud AIO maintainers | Nextcloud AIO Nextcloud application container | Vulnerable | Vulnerable | CVE assessment: Affected: Nextcloud AIO Nextcloud application container uses affected PHP base images; fixed AIO image release not yet confirmed | github.com github.com | |
| Nextcloud Mail project | Nextcloud Mail server app | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Nextcloud Notes project | Nextcloud Notes | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Nextcloud Snap maintainers | Nextcloud Snap bundled PHP runtime | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| NextcloudPi project / Nextcloud community | NextcloudPi turnkey PHP stack | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Nikita Popov / PHP-Parser contributors | PHP-Parser userland parser | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| NixOS / Nixpkgs maintainers | Nixpkgs PHP runtime environments | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | nixos.org wiki.nixos.org | |
| Observium Limited / Observium project | Observium | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.observium.org | |
| October CMS project | October CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.octobercms.com | |
| Open eClass project / GUnet | Open eClass | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.openeclass.org | |
| Open Social project | Open Social Drupal installation profile | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| Open Web Analytics project | Open Web Analytics | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| OpenBSD ports maintainers / PHP documentation team | OpenBSD optional PHP package and ports family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | php.net openbsd.org | |
| OpenCart project | OpenCart | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org github.com | |
| OpenConext / SURF | OpenConext EngineBlock SAML proxy | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com github.com | |
| OpenDocMan project | OpenDocMan | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com opendocman.com | |
| OpenEMR project | OpenEMR | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | github.com | |
| OpenMage project | OpenMage | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.openmage.org packagist.org | |
| openmediavault project | openmediavault PHP management backend | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| OpenSearch Contributors; inherited Elastic client lineage | OpenSearch PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| OpenSwoole project | OpenSwoole native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net | |
| OpenWrt packages feed maintainers | OpenWrt selectable PHP8 package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com | |
| OPNsense / Deciso | OPNsense WebGUI and API | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.opnsense.org docs.opnsense.org | |
| OrangeHRM Inc. | OrangeHRM Starter | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | starterhelp.orangehrm.com github.com | |
| Oro Inc. | OroCommerce | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | doc.oroinc.com | |
| Oro, Inc. | OroCRM Community Edition application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org github.com | |
| osCommerce | osCommerce 4 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | oscommerce.com | |
| osCommerce legacy project | osCommerce Online Merchant 2.3 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | library.oscommerce.com | |
| OVHcloud | OVHcloud webhosting PHP / .ovhconfig runtime | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | docs.ovhcloud.com | |
| ownCloud / Kiteworks | ownCloud Classic 11 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | doc.owncloud.com | |
| ownCloud / Kiteworks | ownCloud Server 10 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | doc.owncloud.com | |
| OXID eSales | OXID eShop | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.oxid-esales.com | |
| Palo Alto Networks | PAN-OS | All PAN-OS versions listed affected; fixed releases not yet announced | Vulnerable | Vulnerable | CVE assessment: Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is adde | docs.paloaltonetworks.com security.paloaltonetworks.com security.paloaltonetworks.com |
| Palo Alto Networks | Panorama | All Panorama versions listed affected; fixed releases not yet announced | Vulnerable | Vulnerable | CVE assessment: Palo Alto Networks lists all PAN-OS and Panorama versions as affected by both CVEs. Fixed releases are forthcoming; restrict management access. No claim of appliance-specific remote code execution is adde | docs.paloaltonetworks.com docs.paloaltonetworks.com security.paloaltonetworks.com |
| Pantheon | Pantheon managed PHP application runtime | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | docs.pantheon.io docs.pantheon.io | |
| ParaTest / Brian Scaturro, Filippo Tessarotto and contributors | ParaTest parallel PHPUnit runner | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| Part-DB project | Part-DB server | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| Passbolt SA | Passbolt API server | Patched Docker/AMI/OVA images published 2026-10-21; runtime PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 or confirmed vendor backport | Fix | Fix | CVE assessment: Passbolt confirms fixed Docker images, AWS AMI and OVA. Distribution installs need an OS PHP update and restart; existing appliances are not patched by publishing new images. Helm rollout remained in prog | passbolt.com passbolt.com |
| PayPal | PayPal Server SDK for PHP | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| PCOV / Joe Watkins and contributors | PCOV PHP native code-coverage driver | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net github.com github.com | |
| PeachPie / iolevel | PeachPie PHP compiler and .NET runtime | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | docs.peachpie.io peachpie.io | |
| PeachPie / WpDotNet project | WpDotNet compiled WordPress on PeachPie | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | peachpie.io | |
| PEAR project / PHP Group | PEAR Base System | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | pear.php.net github.com pecl.php.net | |
| PECL XHProf / longxinH and contributors | XHProf native PHP collection extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net | |
| PECL XHProf / longxinH and contributors | XHProf PHP reporting and navigation UI | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | pecl.php.net | |
| PestPHP / Nuno Maduro and contributors | Pest PHP testing framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org pestphp.com | |
| Phalcon project | Phalcon framework PHP extension | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.phalcon.io docs.phalcon.io pecl.php.net | |
| PHAR.io / Arne Blankerts, Sebastian Heuer and contributors | Phive PHAR installation and verification tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| Phillips Data / Blesta | Blesta billing platform | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.blesta.com | |
| Phing project / Michiel Rook and contributors | Phing PHP build system | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| PHP CS Fixer project | PHP CS Fixer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org cs.symfony.com | |
| PHP CS Fixer project | PHP CS Fixer official PHP container image family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | cs.symfony.com | |
| PHP Depend project | PHP Depend source-metrics analyzer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| PHP Ev extension project | Ev native PHP libev binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net | |
| PHP Event extension project | Event native PHP libevent binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net php.net | |
| PHP Gearman extension project | Gearman native PHP client and worker extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net php.net | |
| PHP gnupg extension project | GnuPG native PHP GPGME binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net php.net gnupg.org | |
| PHP Mailparse extension project | Mailparse native PHP MIME parser extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net php.net | |
| PHP OAuth extension project | OAuth native PHP consumer extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net | |
| PHP SSH2 extension project | SSH2 native PHP client binding | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net | |
| PHP YAML extension project | YAML native PHP parser and emitter extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net packagist.org | |
| php-amqp project | AMQP native PHP messaging client extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net github.com | |
| PHP-FIG | PSR logging interfaces package | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| php-memcached project | Memcached native PHP client extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net github.com | |
| PHP-PM project | PHP-PM process manager | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| php-rdkafka project | rdkafka native PHP Kafka client extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net pecl.php.net | |
| Phpactor project | Phpactor PHP language server and refactoring tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| phpBB Limited / phpBB project | phpBB | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org | |
| PHPBench / Daniel Leech and contributors | PHPBench benchmarking framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| PHPCSStandards / PHP_CodeSniffer project | PHP_CodeSniffer and PHP Code Beautifier/Fixer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org packagist.org | |
| phpDocumentor project | phpDocumentor documentation generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| phpIPAM project | phpIPAM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com phpipam.net | |
| phpLDAPadmin / leenooks project | phpLDAPadmin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| phpList project | phpList | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | resources.phplist.com | |
| PHPMailer project | PHPMailer | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| PHPMD project | PHPMD PHP Mess Detector | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| phpMyAdmin project | phpMyAdmin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | docs.phpmyadmin.net packagist.org | |
| phpMyFAQ project | phpMyFAQ | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | github.com github.com | |
| phpPgAdmin project | phpPgAdmin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| PhpRedis project / Michael Grunder and contributors | PhpRedis native PHP client extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net github.com github.com | |
| PHPro / GrumPHP contributors | GrumPHP Git quality-check orchestration | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| phpseclib project | phpseclib | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| PhpSpec project | PhpSpec specification test runner | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| PHPStan / Ondrej Mirtes and contributors | PHPStan static analyzer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| PHPStan project | PHPStan PHPDoc parser library | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| PHPUnit project | PHPUnit test framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org docs.phpunit.de docs.phpunit.de | |
| PHPUnit project / Sebastian Bergmann | PHPUnit PHP code-coverage library | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| phpVirtualBox project | phpVirtualBox server-side administration application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Pi-hole project | Pi-hole v5 legacy PHP web interface | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | pi-hole.net | |
| Pimcore project | Pimcore Platform | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.pimcore.com docs.pimcore.com | |
| Plesk | Plesk for Linux | All shipped PHP versions | Vulnerable | Vulnerable | CVE assessment: Affected: all PHP versions shipped with Plesk | support.plesk.com |
| Plesk | Plesk for Windows | All shipped PHP versions | Vulnerable | Vulnerable | CVE assessment: Affected: all PHP versions shipped with Plesk | support.plesk.com |
| Plesk | Plesk Obsidian hosted-site PHP | Vulnerable | Vulnerable | CVE assessment: Affected hosted Plesk PHP in aggregate: Linux PHP 7.4, 8.0 and 8.1 plus Windows PHP 8.2-8.5 remain affected; fixed Linux PHP 8.2-8.5 builds are available | docs.plesk.com docs.plesk.com support.plesk.com | |
| Plesk | Plesk plesk-engine internal PHP management runtime for Windows | Vulnerable | Vulnerable | CVE assessment: Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4 | docs.plesk.com support.plesk.com | |
| Plesk | Plesk sw-engine internal PHP management runtime | Vulnerable | Vulnerable | CVE assessment: Affected: all versions of Plesk's internal UI engine component; hotfixes are planned as 18.0.80#11 and 18.0.81#4 | docs.plesk.com support.plesk.com support.plesk.com | |
| PluXml project | PluXml 5.8 documented branch | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | wiki.pluxml.org | |
| PmWiki project | PmWiki | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | pmwiki.org | |
| PostfixAdmin project | PostfixAdmin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Predis project / Till Kruss and contributors | Predis PHP Redis and Valkey client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| PrestaShop project | PrestaShop | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | devdocs.prestashop-project.org | |
| PrivateBin project | PrivateBin | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| ProcessWire project | ProcessWire CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | processwire.com processwire.com | |
| ProjectSend project | ProjectSend | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com docs.projectsend.org | |
| Prophecy / PhpSpec project | Prophecy PHP mocking library | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| Psalm project / Daniil Gentili | Psalm official custom-PHP container image | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | psalm.dev | |
| Psalm project / Matthew Brown, Daniil Gentili and contributors | Psalm PHP static analyzer | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| PsySH / Justin Hileman and contributors | PsySH interactive PHP shell | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| Pterodactyl project | Pterodactyl Panel PHP application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| Public Knowledge Project (PKP) | Open Journal Systems | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Public Knowledge Project (PKP) | Open Monograph Press | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Public Knowledge Project (PKP) | Open Preprint Systems | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Pydio | Pydio 8 Enterprise Distribution | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.pydio.com github.com | |
| QloApps | QloApps | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | github.com api.github.com | |
| QNAP | QNAP PHP7.4 optional application before5.2 migration | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | qnap.com | |
| QNAP | QNAP QTS built-in PHP runtime | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | qnap.com qnap.com | |
| QNAP | QNAP QuTS hero built-in PHP runtime | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | qnap.com qnap.com | |
| Quest Software | KACE Systems Management Appliance | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | support.quest.com support.quest.com | |
| RainLoop Team | RainLoop Webmail | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | rainloop.net github.com | |
| RaspAP project | RaspAP PHP network-management web GUI | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.raspap.com | |
| ReactPHP project | ReactPHP EventLoop | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Rector project | Rector automated PHP refactoring tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| Red Hat | Red Hat Enterprise Linux 9 PHP RPM/AppStreams | Vulnerable | Vulnerable | CVE assessment: Affected: Red Hat lists the RHEL 9 PHP component family as affected; scoped php:8.2 fix recorded separately | docs.redhat.com access.redhat.com access.redhat.com | |
| Red Hat | Red Hat Enterprise Linux 9 php:8.2 module | 8.2.35-1.module+el9.8.0+25111+a1450321 | Fix | Fix | CVE assessment: Fixed in Red Hat Enterprise Linux 9 php:8.2 module package php-8.2.35-1.module+el9.8.0+25111+a1450321 | access.redhat.com |
| Render; customer/base-image publisher | Render customer PHP Docker hosting | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | render.com render.com | |
| RoadRunner PHP community | RoadRunner common PHP worker package | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org packagist.org | |
| RoadRunner project | RoadRunner configured PHP worker-pool integration | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown | docs.roadrunner.dev | |
| Roave | Roave backward-compatibility checker | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| Roundcube project | Roundcube Webmail | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | github.com packagist.org github.com | |
| Roundcube project | Roundcube Webmail Docker image family | Unrebuilt Roundcube Docker variants using pre-fix PHP 8.4 base images | Vulnerable | Vulnerable | CVE assessment: Roundcube's maintainer confirms that image rebuilds are needed after patched PHP base images arrive and reports build failures. No complete set of published fixed Roundcube tags is confirmed in the review | github.com github.com |
| SalesAgility / SuiteCRM project | SuiteCRM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.suitecrm.com docs.suitecrm.com | |
| Sangoma | PBXact 17 PHP management edition | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | freepbx.org | |
| Sangoma / FreePBX project | FreePBX 17 management framework | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | sangomakb.atlassian.net github.com | |
| Scalingo | Scalingo PaaS | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | doc.scalingo.com | |
| Scalingo | Scalingo PHP buildpack | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | doc.scalingo.com | |
| Sean Morris / php-wasm project | php-cgi-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | github.com | |
| Sean Morris / php-wasm project | php-cli-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | github.com | |
| Sean Morris / php-wasm project | php-cloud-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | github.com | |
| Sean Morris / php-wasm project | php-dbg-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | github.com | |
| Sean Morris / php-wasm project | php-sdl-wasm package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | github.com | |
| Sean Morris / php-wasm project | php-wasm-builder package (Sean Morris) | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | github.com | |
| Sean Morris / php-wasm project | Sean Morris php-wasm runtime package | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | github.com | |
| Securepoint GmbH | Securepoint Resellerportal | Investigation | Investigation | CVE assessment: Live vendor portal exposes Laravel application markers; exact PHP runtime and CVE scope unknown | my.securepoint.de laravel.com | |
| Semantic MediaWiki project | Semantic MediaWiki | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Sendy | Sendy self-hosted application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | sendy.co sendy.co | |
| Serendipity project | Serendipity Blog System | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.s9y.org | |
| Shaarli community | Shaarli | Shaarli Docker distribution awaiting a patched Alpine base at review time | Vulnerable | Vulnerable | CVE assessment: Shaarli's maintainer confirms that its Docker distribution needs the Alpine PHP security fix and that a new release is pending. This finding is scoped to the container runtime, not a Shaarli application-c | github.com github.com |
| Shivam Mathur / setup-php project | setup-php GitHub Action external PHP provisioning | Patched setup-php v2-provisioned PHP builds announced 2026-10-21 | Fix | Fix | CVE assessment: The setup-php owner announces patched Linux, macOS and Windows PHP builds, including emergency EOL backports. This concerns the provisioned runtime; Windows, self-hosted runners and containers require upd | github.com github.com |
| Shlink project | Shlink | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org github.com | |
| Shopify | Shopify API Library for PHP deprecated line | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | packagist.org | |
| Shopify | Shopify App PHP package | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| Shopware 5 project / shopware AG lineage | Shopware 5 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org | |
| shopware AG | Shopware 6 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.shopware.com developer.shopware.com | |
| Silverstripe CMS project | Silverstripe CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.silverstripe.org | |
| Simple Machines / SMF project | Simple Machines Forum | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| SimpleRisk | SimpleRisk PHP GRC application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | support.simplerisk.com | |
| SimpleSAMLphp project | SimpleSAMLphp | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org | |
| Slim project | Slim framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org | |
| SnappyMail project | SnappyMail | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| SolidWorx / SolidInvoice project | SolidInvoice application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| SolidWorx / SolidInvoice project | SolidInvoice self-contained binary | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | solidinvoice.co | |
| Sophos | MyUTM portal | Investigation | Investigation | CVE assessment: Vendor advisory names product or service in php2shell response; exact affected/fixed product scope still under investigation | sophos.com | |
| SPIP project | SPIP | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | spip.net | |
| Spryker Systems GmbH | Spryker Commerce OS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.spryker.com docs.spryker.com | |
| SquirrelMail project | SquirrelMail legacy documented webmail | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | squirrelmail.org | |
| Statamic project | Statamic CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | statamic.dev | |
| Statamic project | Statamic static-site generator | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | statamic.dev | |
| Stripe and contributors | Stripe PHP client library | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| SugarAI / SugarCRM | Sugar application server | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | support.sugarai.com | |
| Sulu project | Sulu CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.sulu.io | |
| SURF | SURF Research Access Management EngineBlock proxy | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | servicedesk.surf.nl github.com github.com | |
| SURF | SURF Research Drive Nextcloud server component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | surf.nl docs.nextcloud.com | |
| SURF | SURFconext OpenConext EngineBlock proxy role | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | openconext.org openconext.org github.com | |
| SURF | SURFdrive Nextcloud server component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | surf.nl docs.nextcloud.com | |
| SURF | SURFfilesender FileSender server component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | surf.nl docs.filesender.org | |
| SURF / SURFnet | SURFconext Service Provider Dashboard | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| SUSE | SUSE Linux Enterprise PHP8 package families | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | documentation.suse.com suse.com | |
| SUSE | SUSE SLE BCI PHP CLI container | Not vuln | Not vuln | CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image d | registry.suse.com lists.suse.com suse.com | |
| SUSE | SUSE SLE BCI PHP-Apache container | Not vuln | Not vuln | CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image d | registry.suse.com lists.suse.com suse.com | |
| SUSE | SUSE SLE BCI PHP-FPM 8 container | Not vuln | Not vuln | CVE assessment: SUSE lists the bci/php, bci/php-apache and bci/php-fpm container families as Not affected for both CVEs. This records the current vendor family assessment, not a guarantee for arbitrary historical image d | registry.suse.com lists.suse.com suse.com | |
| Swoole project | Swoole native PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net | |
| Sylius project | Sylius | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.sylius.com | |
| Sylvain Lassaut / NoiseByNorthwest | SPX native PHP profiling extension and built-in report UI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com github.com | |
| Symfony | Symfony Console component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Symfony | Symfony framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | symfony.com symfony.com packagist.org | |
| Symfony | Symfony HttpFoundation component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Symfony | Symfony HttpKernel component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Symfony | Symfony mbstring polyfill | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Symfony | Symfony Process component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Symplify | Easy Coding Standard PHP style tool | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | packagist.org | |
| Synology | Synology PHP 5.6 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology PHP 7.0 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology PHP 7.2 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology PHP 7.3 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology PHP 7.4 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology PHP 8.0 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology PHP 8.1 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology PHP 8.2 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology PHP 8.3 archived package family | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology PHP 8.4 package distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | archive.synology.com archive.synology.com | |
| Synology | Synology Web Station optional PHP hosting | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | synology.com | |
| TeamPass project | TeamPass | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| TerraMaster | TerraMaster TOS6 Web Server optional PHP hosting | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | help.terra-master.com | |
| Textpattern project | Textpattern CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | textpattern.com textpattern.com | |
| The Cacti Group | Cacti | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| The PHP Foundation / PHP PIE project | PHP Installer for Extensions (PIE) | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | github.com pecl.php.net packagist.org | |
| The PHP Group | PHP BCMath | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP built-in development web server | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com php.net | |
| The PHP Group | PHP Bzip2 | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Calendar | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Clang fuzzer SAPI | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | raw.githubusercontent.com | |
| The PHP Group | PHP CLI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com docs.phpunit.de | |
| The PHP Group | PHP COM and .NET | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com | |
| The PHP Group | PHP core and Zend Engine | none | none | Unversioned PHP runtime family anchor for downstream dependency links; version-scoped affected and fixed runtime variants are recorded separately. | raw.githubusercontent.com raw.githubusercontent.com php.net | |
| The PHP Group | PHP core and Zend Engine affected web-serving release scope | >=5.4.0 before fixed release or vendor backport; supported branches <8.2.35, <8.3.36, <8.4.27, <8.5.12 | Vulnerable | Vulnerable | CVE assessment: Affected web-serving PHP runtime scope; supported upstream branches are affected below 8.2.35, 8.3.36, 8.4.27 and 8.5.12, while older branches require vendor backports or upgrade. | php.net github.com github.com |
| The PHP Group | PHP core and Zend Engine fixed upstream releases | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers | php.net github.com github.com |
| The PHP Group | PHP Ctype | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP cURL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Date/Time | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP DBA | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP dl_test | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP DOM | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Embed SAPI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com | |
| The PHP Group | PHP Enchant | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Exif | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP FFI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Fileinfo | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Filter | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP FTP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP GD | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Gettext | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP GMP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Hash | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Iconv | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP IMAP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net php.net php.net | |
| The PHP Group | PHP Intl | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP JSON | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP LDAP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Lexbor support bridge | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Libxml bridge | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP LiteSpeed SAPI | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers | raw.githubusercontent.com php.net |
| The PHP Group | PHP Mbstring | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP MySQLi | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Mysqlnd | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP OCI8 extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net php.net php.net | |
| The PHP Group | PHP ODBC | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP OPcache | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com php.net | |
| The PHP Group | PHP OPcache JIT | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com php.net | |
| The PHP Group | PHP OpenSSL extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP PCNTL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com | |
| The PHP Group | PHP PCRE | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP PDO | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP PDO_DBLIB | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP PDO_FIREBIRD | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP PDO_MYSQL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP PDO_OCI extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net php.net pecl.php.net | |
| The PHP Group | PHP PDO_ODBC | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP PDO_PGSQL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP PDO_SQLITE | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Phar | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP phpdbg | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com | |
| The PHP Group | PHP POSIX | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com | |
| The PHP Group | PHP PostgreSQL extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Pspell extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | pecl.php.net php.net php.net | |
| The PHP Group | PHP Random | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Readline | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Reflection | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Session | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Shmop | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP SimpleXML | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP SNMP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP SOAP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Sockets | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Sodium | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP SPL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP SQLite3 | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Standard functions | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Sysvmsg | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com | |
| The PHP Group | PHP Sysvsem | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com | |
| The PHP Group | PHP Sysvshm | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Tidy | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Tokenizer | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP URI | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com php.net | |
| The PHP Group | PHP XML parser | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP XMLReader | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP XMLWriter | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP XSL | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP zend_test | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Zip | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP Zlib extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | raw.githubusercontent.com raw.githubusercontent.com | |
| The PHP Group | PHP-CGI | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers | raw.githubusercontent.com php.net php.net |
| The PHP Group | PHP-FPM | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers | raw.githubusercontent.com php.net php.net |
| The PHP Group / Apache operators | Apache PHP module (mod_php) | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; advisory names PHP-FPM, Apache with mod_php, php-cgi and LiteSpeed among at-risk web request handlers | raw.githubusercontent.com docs.nextcloud.com php.net |
| The PHP Group / PHP Windows maintainers | Official PHP Windows binary ZIP distribution | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | Fix | Fix | CVE assessment: Fixed upstream Windows binaries are available for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 | php.net php.net downloads.php.net |
| The PHP League | Flysystem | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Thelia project | Thelia | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | doc.thelia.net doc.thelia.net | |
| thirty development llc / thirty bees project | thirty bees | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | thirtybees.com github.com | |
| Thunder project | Thunder Drupal distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | thunder.org | |
| Tideways / open-source fork contributors | Tideways XHProf archived native extension fork | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | github.com | |
| Tideways GmbH | Tideways commercial PHP profiling extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | support.tideways.com tideways.com | |
| Tiki Software Community Association / Tiki project | Tiki Wiki CMS Groupware | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | doc.tiki.org | |
| Totara | Totara | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | totara.help | |
| TransIP | TransIP API PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| TransIP | TransIP shared webhosting PHP option | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | transip.nl | |
| Trend Micro | Apex Central | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | files.trendmicro.com | |
| Trend Micro | Apex One | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | files.trendmicro.com | |
| TurnKey Linux | TurnKey Linux LAMP appliance PHP stack | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | turnkeylinux.org | |
| TurnKey Linux | TurnKey Linux LAPP appliance PHP stack | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | turnkeylinux.org | |
| TuxCare / CloudLinux | TuxCare ELS PHP distribution family | Vulnerable | Vulnerable | CVE assessment: Affected package streams: CloudLinux ea-php and broad TuxCare PHP ELS family; scoped fixed ELS rows are recorded separately | docs.tuxcare.com cloudlinux.zendesk.com cloudlinux.statuspage.io | |
| TuxCare / CloudLinux | TuxCare ELS PHP package for CentOS 8.4 | 7.4.6 | Fix | Fix | CVE assessment: Fixed in TuxCare ELS php-7.4.6 for CentOS 8.4 ELS | cloudlinux.statuspage.io docs.tuxcare.com |
| TuxCare / CloudLinux | TuxCare ELS PHP package for CentOS 8.5 | 7.4.19 | Fix | Fix | CVE assessment: Fixed in TuxCare ELS php-7.4.19 for CentOS 8.5 ELS | cloudlinux.statuspage.io docs.tuxcare.com |
| TuxCare / CloudLinux | TuxCare ELS PHP package for Ubuntu 16.04 | 7.0.33 | Fix | Fix | CVE assessment: Fixed in TuxCare ELS php-7.0.33 for Ubuntu 16.04 ELS | cloudlinux.statuspage.io docs.tuxcare.com |
| TuxCare / CloudLinux | TuxCare ELS PHP package for Ubuntu 18.04 | 7.2.24-0 | Fix | Fix | CVE assessment: Fixed in TuxCare ELS php-7.2.24-0 for Ubuntu 18.04 ELS | cloudlinux.statuspage.io docs.tuxcare.com |
| Twig / Symfony community | Twig template engine | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org twig.symfony.com | |
| Twilio API Team | Twilio PHP helper SDK | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| Twilio SendGrid | Twilio SendGrid PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown | packagist.org | |
| TYPO3 project | TYPO3 13.4 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.typo3.org get.typo3.org | |
| UnoPim | UnoPim | Investigation | Investigation | CVE assessment: Official PHP requirement or GitHub SBOM evidence only; CVE match unknown | github.com api.github.com | |
| Upsun | Upsun PHP application containers | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | developer.upsun.com | |
| Utrecht University / Yoda | Yoda v1.5 legacy PHP web portal | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | utrechtuniversity.github.io | |
| Uwe Steinmann / SeedDMS project | SeedDMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | seeddms.org seeddms.org | |
| Vance Lucas / Graham Campbell / phpdotenv contributors | phpdotenv | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| Vanderbilt University / REDCap Consortium | REDCap | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | projectredcap.org | |
| Vardot / Varbase project | Varbase Drupal distribution | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | docs.varbase.vardot.com | |
| Virtualmin | Virtualmin hosted PHP execution modes | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | virtualmin.com | |
| VirtueMart project | VirtueMart | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | virtuemart.net | |
| VitalPBX | VitalPBX 4.0 PHP management runtime | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | forums.vitalpbx.org | |
| VitalPBX | VitXi server-side PHP component | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | vitalpbx.com | |
| VK / VKCOM KPHP project | KPHP compiler and native runtime | Investigation | Investigation | CVE assessment: Independent engine; no automatic inheritance | vkcom.github.io vkcom.github.io | |
| VK / VKCOM KPHP project | KPHP vkext development PHP extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | vkcom.github.io vkcom.github.io | |
| Vtiger | Vtiger CRM Open Source | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | help.vtiger.com | |
| VuFind project / Villanova University | VuFind | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| wallabag project | wallabag | Investigation | Investigation | CVE assessment: Official PHP requirement or SBOM evidence only; CVE match unknown | doc.wallabag.org | |
| WampServer maintainers / Aviatechno | WampServer Windows development bundle | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | wampserver.aviatechno.net | |
| webERP project | webERP | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | weberp.org | |
| Webkul | Bagisto | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | devdocs.bagisto.com devdocs.bagisto.com | |
| Webkul / UVdesk | UVdesk Community Helpdesk | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com github.com | |
| webonyx / GraphQL-PHP project | webonyx GraphQL-PHP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org | |
| WebPros / cPanel | cPanel EasyApache 4 / MultiPHP | EA4 25.91: ea-php82 8.2.35; ea-php83 8.3.36; ea-php84 8.4.27; ea-php85 8.5.12; vendor-patched ea-php74/80/81 | Fix | Fix | CVE assessment: EA4 25.91 fixes both CVEs in ea-php82/83/84/85 and backports them to ea-php74/80/81. Older retained branches and third-party repositories are not covered by this confirmation. | docs.cpanel.net docs.cpanel.net |
| WebPros / cPanel | cPanel internal PHP for hooks and AppConfig applications | cPanel & WHM 136.0.50; bundled cpanel-php84 8.4.27 | Fix | Fix | CVE assessment: cPanel & WHM 136.0.50 updates its internal cpanel-php84 to 8.4.27 and explicitly fixes both CVEs. This is separate from hosted-site EA4 PHP. | docs.cpanel.net api.docs.cpanel.net docs.cpanel.net |
| Whirl-i-Gig / CollectiveAccess project | CollectiveAccess Providence | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.collectiveaccess.org | |
| WHMCS Ltd. | WHMCS self-hosted application | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | docs.whmcs.com docs.whmcs.com | |
| Wikimedia / MediaWiki Platform maintainers | Excimer native PHP interrupting timer and sampling profiler | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | packagist.org pecl.php.net mediawiki.org | |
| Wikimedia / MediaWiki project | Parsoid PHP | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | mediawiki.org | |
| Wikimedia Foundation | Wikimedia MediaWiki application-server PHP tier | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | wikitech.wikimedia.org mediawiki.org | |
| Winter CMS project | Winter CMS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | wintercms.com wintercms.com wintercms.com | |
| WoltLab GmbH | WoltLab Suite | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | manual.woltlab.com manual.woltlab.com | |
| WooCommerce | WooCommerce | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | woocommerce.com | |
| WooCommerce | WooCommerce PayPal Payments | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | wordpress.org | |
| WooCommerce | WooCommerce Stripe Payment Gateway | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | wordpress.org | |
| WooCommerce | WooPayments merchant plugin | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com wordpress.org github.com | |
| WordPress Playground contributors | PHP.wasm browser platform adapter | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | developer.wordpress.org | |
| WordPress Playground contributors | PHP.wasm Node.js platform adapter | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | developer.wordpress.org developer.wordpress.org | |
| WordPress Playground contributors | PHP.wasm universal JavaScript API | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | developer.wordpress.org | |
| WordPress Playground contributors | WordPress Playground browser and local runtime | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | developer.wordpress.org | |
| WordPress Playground contributors | WordPress Playground PHP.wasm binary family | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown | developer.wordpress.org github.com | |
| WordPress project | WordPress | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; PHP upstream confirms this runtime scope and Calif confirmed representative application-level pre-auth RCE. The remediation is the PHP runtim | wordpress.org make.wordpress.org | |
| WP Engine | WP Engine managed WordPress PHP hosting | Investigation | Investigation | CVE assessment: Hosted PHP option; CVE match unknown | wpengine.com | |
| WP-CLI / WordPress project | WP-CLI WordPress administration framework | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown | ||
| X-Cart | X-Cart 5 | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | developer.x-cart.com | |
| Xdebug / Derick Rethans and contributors | Xdebug PHP Zend instrumentation extension | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | xdebug.org xdebug.org | |
| Xdebug / vscode-php-debug contributors | VS Code PHP Debug adapter external PHP/Xdebug integration | Investigation | Investigation | CVE assessment: Optional PHP path; CVE match unknown | github.com github.com | |
| XenForo Ltd | XenForo | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.xenforo.com | |
| XigmaNAS project | XigmaNAS bundled PHP components | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | xigmanas.com | |
| YetiForce S.A. | YetiForce CRM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | doc.yetiforce.com github.com github.com | |
| Yii Software / Yii project | Yii 2 framework | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | packagist.org | |
| Yii Software / Yii project | Yii Web extension abandoned prototype | Investigation | Investigation | CVE assessment: Historical scope; current use unknown | packagist.org | |
| YOURLS project | YOURLS | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | github.com | |
| Zabbix | Zabbix web frontend | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | zabbix.com zabbix.com | |
| Zen Cart project | Zen Cart | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the appli | docs.zen-cart.com | |
| ZoneMinder project | ZoneMinder PHP web and API components | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown | github.com |