A critical SQL injection vulnerability exists in PHP Jabbers Car Rental Script versions prior to 4.1. The flaw arises from improper neutralization of user input in parameters used for sorting functions, allowing unauthenticated attackers to perform SQL injection attacks. This vulnerability has a CVSS 4.0 score of 9.3, indicating high severity. The issue was fixed in version 4.1.
CVE-2026-7260 is a stack-based buffer overflow vulnerability in PHP caused by circular symbolic links in phar archives. This flaw can trigger unbounded recursion, exhausting the C stack and crashing the PHP process. It affects PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation level is currently confirmed in the provided data.
CVE-2026-17544 is a high-severity vulnerability in the PHP programming language affecting versions 8.4.0 through 8.4.23 and 8.5.0 through 8.5.8. It involves an out-of-bounds write triggered by attacker-controlled inputs to the bccomp() function, which can cause stack and heap corruption. This vulnerability could potentially lead to serious memory corruption issues. No official patch or remediation level has been confirmed yet.
CVE-2026-17543 is a high-severity SQL injection vulnerability in PHP caused by improper escaping of backslashes in attacker-supplied parameters. It affects multiple PHP versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9. This flaw allows attackers to perform SQL injection attacks due to improper neutralization of special elements in SQL commands. No official patch or remediation level is currently confirmed.
CVE-2026-63227 is a critical vulnerability in Koollab LMS version 5.3.2 that allows an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory. This unrestricted file upload vulnerability enables arbitrary code execution on the server without user interaction.
PhpSpreadsheet versions up to 5.8.0 (and several earlier branches) contain a vulnerability in the Gnumeric file reader where attacker-supplied .gnumeric files starting with gzip magic bytes can cause excessive memory consumption. This happens because the library calls gzdecode() on the full compressed contents without limiting the decompressed size, potentially leading to a denial of service by crashing the PHP process. The issue is fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection, OLERead::read() appends the same sector data repeatedly until the PHP process exhausts memory. This is reachable from Reader\Xls::canRead() and therefore from automatic spreadsheet type detection. Applications that accept attacker-controlled spreadsheet uploads can suffer denial of service from a very small file. This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18 and 1.30.6.
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE() domain whitelist can be bypassed via an HTTP redirect (SSRF). In Calculation/Web/Service.php, the webService() method validates a URL's host against the whitelist set via Spreadsheet::setDomainWhiteList(), then fetches content with file_get_contents($url, false, $ctx); because PHP's HTTP stream wrapper follows 301/302 redirects automatically (up to 20 hops) and the redirect target is never re-validated, an attacker who can trigger a redirect from a whitelisted domain can reach arbitrary URLs, including internal addresses. An attacker able to upload XLSX files to an application that uses setDomainWhiteList() and getCalculatedValue() can achieve a full-read SSRF, returning up to 32,767 bytes of the response body as a cell's calculated value, which enables exfiltration of cloud metadata (AWS/GCP/Azure credentials via http://169.254.169.254/), access to internal-only services, and internal port scanning (the port is not validated). This issue has been fixed in versions 5.8.1, 3.10.7, 2.4.7, 2.1.18, and 1.30.6.
The SysBasics Customize My Account for WooCommerce – Live My Account Customizer WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw via the 'row_type' parameter in all versions up to and including 4.4.14. This vulnerability allows authenticated users with shop manager-level privileges or higher to inject malicious scripts that execute when other users access the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the sandbox policy. This issue is fixed in version 3.27.0.
Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allowing PHP to invoke __toString() on a Stringable object used as a mapping key without calling SandboxExtension::ensureToStringAllowed(). This issue is fixed in version 3.27.0.
Twig is a template language for PHP. Prior to 3.27.0, the column filter passes the active sandbox state as a boolean but does not forward the current Source to SandboxExtension::checkPropertyAllowed(), so SourcePolicyInterface decisions are lost and a template author can read public or magic properties not allowed by the sandbox policy. This issue is fixed in version 3.27.0.
Twig, a PHP template language, has a protection mechanism failure vulnerability in versions prior to 3.27.0. Deprecated internal wrappers in src/Resources/core.php do not correctly forward the current sandbox state to certain functions, allowing legacy calls to bypass sandbox callable restrictions. This issue is addressed in version 3.27.0.
Twig is a template language for PHP. Prior to 3.27.0, the per-template filter, tag, and function allow-list verdict is computed when a Template instance is constructed and can remain cached after sandbox state changes between renders, allowing a later sandboxed render to reuse a template that was originally checked with a different or empty policy. This issue is fixed in version 3.27.0.
Twig before version 3.26.0 improperly marks several filters in twig/markdown-extra and twig/cssinliner-extra as safe for all output contexts, including HTML, JavaScript, CSS, and URLs, without proper escaping. This can lead to improper encoding or escaping of output, potentially causing security issues. The vulnerability is fixed in version 3.26.0.
Twig, a PHP template language, has a protection mechanism failure vulnerability prior to version 3.26.0. The issue involves the sandbox feature where {% sandbox %}{% include %} can include a template previously loaded outside the sandbox without re-checking security policies. This allows cached templates to use tags, filters, and functions that should have been denied by SecurityPolicy::checkSecurity(). The vulnerability is fixed in version 3.26.0.
Twig, a PHP template language, has a code injection vulnerability (CWE-94) in versions from 3.15.0 up to but not including 3.26.0. The issue arises from improper validation of dynamic attribute syntax that allows attacker-controlled strings to be concatenated into MacroReferenceExpression names, resulting in raw PHP code execution at template load time. This vulnerability is rated high severity with a CVSS score of 8.7. The vulnerability is fixed in version 3.26.0.
Twig versions prior to 3.26.0 contain a vulnerability where IntlDateFormatter and NumberFormatter instances are memoized without limits based on template-controlled arguments. This can lead to excessive resource allocation that persists for the lifetime of the Twig environment. The issue is addressed in version 3.26.0.
Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate() and Profile::getName() into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dump. This issue is fixed in version 3.26.0.
Twig, a PHP template language, has an improper encoding vulnerability in versions prior to 3.26.0. The deprecated spaceless filter is incorrectly registered as safe for HTML, which causes Twig's autoescaping mechanism to fail and emit unescaped attacker-controlled markup when spaceless is applied to untrusted input. This vulnerability is fixed in version 3.26.0.