slug: php

Explanation

PHPはサーバーサイドで動くプログラミング言語で、Webサイトの裏側を作るのに広く使われています。 WordPress、Laravel、Drupalなど、世界中の多くのサイトの土台になっています。 セキュリティ脆弱性の文脈では「インジェクション系」(攻撃文字列を実行させる) や「ファイルアップロードの不備」が典型的な弱点として知られています。
📌 Example
2017年のEquifax事件 (1.4億人の個人情報流出) は、Apache StrutsというJavaライブラリの脆弱性が原因でしたが、同様にPHPアプリケーションでも脆弱性が悪用された事例は多数あります。

🔖 Related tags

🛡 Vulnerabilities tagged with this 6,252

Image ID Title
CVE-2026-36669 Unrestricted File Upload in Feng Office (CVE-2026-36669)
CVE-2026-16009 Vulnerability in itsourcecode Hospital Management System (CVE-2026-16009)
CVE-2026-15982 Privilege Escalation in WordPress (CVE-2026-15982)
CVE-2026-14503 Information Disclosure in pCloud WP Backup (WordPress plugin) (CVE-2026-14503)
CVE-2026-62237 Vulnerability in Grav (CVE-2026-62237)
CVE-2026-62230 Vulnerability in Grav (CVE-2026-62230)
CVE-2026-55579 Vulnerability in pheditor/pheditor (CVE-2026-55579)
CVE-2026-55578 OS Command Injection in pheditor/pheditor (CVE-2026-55578)
CVE-2026-54540 OS Command Injection in pheditor/pheditor (CVE-2026-54540)
CVE-2026-46512 Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_dialplan_apply accepted template…
CVE-2026-46514 Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in…
CVE-2026-46513 Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by…
CVE-2026-46687 Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a…
CVE-2026-46686 Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword…
CVE-2026-54733 The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration…
CVE-2026-63304 OS Command Injection in AVideo (CVE-2026-63304)
CVE-2026-63305 OS Command Injection in AVideo (CVE-2026-63305)
CVE-2026-59859 Code Injection in Microsoft.OpenApi.Kiota (CVE-2026-59859)
CVE-2026-15005 Cross-Site Request Forgery (CSRF) in Loco Translate (WordPress plugin) (CVE-2026-15005)
CVE-2026-15008 Unsafe Deserialization in WordPress (CVE-2026-15008)
CVE-2026-15909 Vulnerability in RafyMrX TOKO-ONLINE-ROTI (CVE-2026-15909)
CVE-2026-54494 SSRF (Server-Side Request Forgery) in phanan/koel (CVE-2026-54494)
CVE-2026-54493 SSRF (Server-Side Request Forgery) in phanan/koel (CVE-2026-54493)
CVE-2026-54492 SSRF (Server-Side Request Forgery) in phanan/koel (CVE-2026-54492)
CVE-2026-47156 Authentication Bypass in mantisbt/mantisbt (CVE-2026-47156)
CVE-2026-61873 Vulnerability in Grav (CVE-2026-61873)
CVE-2026-61457 Unrestricted File Upload in Grav API plugin (CVE-2026-61457)
CVE-2026-59235 Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api...
CVE-2026-46627 Vulnerability in Twig (CVE-2026-46627)
CVE-2026-54087 Unrestricted File Upload in easycorp/easyadmin-bundle (CVE-2026-54087)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details