slug: php

Explanation

PHPはサーバーサイドで動くプログラミング言語で、Webサイトの裏側を作るのに広く使われています。 WordPress、Laravel、Drupalなど、世界中の多くのサイトの土台になっています。 セキュリティ脆弱性の文脈では「インジェクション系」(攻撃文字列を実行させる) や「ファイルアップロードの不備」が典型的な弱点として知られています。
📌 Example
2017年のEquifax事件 (1.4億人の個人情報流出) は、Apache StrutsというJavaライブラリの脆弱性が原因でしたが、同様にPHPアプリケーションでも脆弱性が悪用された事例は多数あります。

🔖 Related tags

🛡 Vulnerabilities tagged with this 6,263

Image ID Title
CVE-2026-46697 SSRF (Server-Side Request Forgery) in WordPress (CVE-2026-46697)
CVE-2026-48062 Unrestricted File Upload in codeigniter4/framework (CVE-2026-48062)
CVE-2026-8406 openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging...
CVE-2026-38581 SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote...
CVE-2026-48998 Vulnerability in guzzlehttp/psr7 (CVE-2026-48998)
CVE-2026-49214 Vulnerability in guzzlehttp/psr7 (CVE-2026-49214)
CVE-2026-10721 Unsafe Deserialization in concrete5/concrete5 (CVE-2026-10721)
CVE-2026-34417 Cross-Site Scripting (XSS) in OSCAL-GUI (CVE-2026-34417)
CVE-2026-48030 OS Command Injection in pheditor/pheditor (CVE-2026-48030)
CVE-2026-47767 Vulnerability in symfony/runtime (CVE-2026-47767)
CVE-2026-25557 Cross-Site Scripting (XSS) in Evoluted PHP Directory Listing Script (CVE-2026-25557)
CVE-2026-47906 Vulnerability in Adobe macOS (CVE-2026-47906)
CVE-2026-39169 Vulnerability in SEMCMS (CVE-2026-39169)
CVE-2026-39170 Cross-Site Request Forgery (CSRF) in SemCms (CVE-2026-39170)
CVE-2026-38615 OS Command Injection in DedeCMS (CVE-2026-38615)
CVE-2017-20251 Code Injection in WordPress Insert PHP plugin (CVE-2017-20251)
CVE-2017-20244 SQL Injection in Wow Forms WordPress Plugin (CVE-2017-20244)
CVE-2017-20245 SQL Injection in WordPress Wow Viral Signups (CVE-2017-20245)
CVE-2017-20246 SQL Injection in WordPress KittyCatfish (CVE-2017-20246)
CVE-2017-20248 Path Traversal in Apptha Slider Gallery (CVE-2017-20248)
CVE-2017-20250 Path Traversal in Mac Photo Gallery (CVE-2017-20250)
CVE-2016-20065 SQL Injection in WordPress Product Catalog (CVE-2016-20065)
CVE-2016-20062 SQL Injection in WordPress Simply Poll (CVE-2016-20062)
CVE-2026-49740 Unsafe Deserialization in typo3/cms-core (CVE-2026-49740)
CVE-2026-8365 Unsafe Deserialization in Blocksy (WordPress theme) (CVE-2026-8365)
CVE-2026-9662 Vulnerability in Recover Exit For WooCommerce (WordPress plugin) (CVE-2026-9662)
CVE-2026-8895 Cross-Site Scripting (XSS) in kk blog card (WordPress plugin) (CVE-2026-8895)
CVE-2026-8940 Cross-Site Request Forgery (CSRF) in WP Meta Sort Posts (WordPress plugin) (CVE-2026-8940)
CVE-2026-8499 Vulnerability in Helpfulcrowd Product Reviews (WordPress plugin) (CVE-2026-8499)
CVE-2026-11603 Cross-Site Scripting (XSS) in Product Filter Widget for Elementor (WordPress plugin) (CVE-2026-11603)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details