CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
DedeCMS Local File Inclusion (LFI) Vulnerability in carbuyaction.php (CVE-2010-20125)
[Affected Scope] All DedeCMS installations prior to version 5.7
[Impact] Remote unauthenticated attackers can disclose sensitive local files or system configurations via path traversal sequences
[Mitigation] Upgrade to DedeCMS 5.7 or later, or manually patch the uninitialized variable in the affected PHP script
PHP Remote Code Execution (RCE) via Global State Use-After-Free (CVE-2026-109619)
[Affected Scope] PHP 8.1, 8.2, and 8.3 environments without the latest security patches.
[Impact] Remote attackers can achieve arbitrary code execution (RCE) by exploiting memory corruption in the PHP global state.
[Mitigation] Immediately update PHP to the latest security release and restart PHP-FPM/Web server processes.
PHP Remote Code Execution (RCE) via OOM Memory Corruption (CVE-2026-109618)
[Affected Scope] All web applications and server environments running on the PHP engine.
[Impact] Unauthenticated remote attackers can trigger Out-of-Memory (OOM) conditions to execute arbitrary code (RCE) with system privileges.
[Mitigation] Immediately apply official PHP security patches and restrict abnormal memory allocation via php.ini configurations.
PHP-CGI Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2024-4577)
[Affected Scope] PHP versions 8.1.x (before 8.1.29), 8.2.x (before 8.2.20), and 8.3.x (before 8.3.8) running on Windows with Apache and PHP-CGI configuration under specific system code pages
[Impact] Unauthenticated remote attackers can inject arbitrary command-line options into the PHP binary, leading to remote code execution (RCE) and source code disclosure
[Mitigation] Immediately upgrade to patched PHP versions (8.1.29, 8.2.20, 8.3.8 or later) or apply Apache Rewrite rules to block malicious query strings