CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
PHP-CGI Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2024-4577)
[Affected Scope] PHP versions 8.1.x (before 8.1.29), 8.2.x (before 8.2.20), and 8.3.x (before 8.3.8) running on Windows with Apache and PHP-CGI configuration under specific system code pages
[Impact] Unauthenticated remote attackers can inject arbitrary command-line options into the PHP binary, leading to remote code execution (RCE) and source code disclosure
[Mitigation] Immediately upgrade to patched PHP versions (8.1.29, 8.2.20, 8.3.8 or later) or apply Apache Rewrite rules to block malicious query strings
PHP-CGI Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2012-1823)
[Affected Scope] PHP versions before 5.3.12 and 5.4.x before 5.4.2, configured to run as a CGI script (php-cgi)
[Impact] Unauthenticated remote attackers can execute arbitrary code by injecting command-line options via HTTP query strings
[Mitigation] Upgrade to patched PHP versions or configure web server rewrite rules to block malicious query strings