en
AI-Powered Ad Tech for Measurable Performance | PubMatic
Drive measurable advertising performance with PubMatic's AI-powered, agentic platform — built for buyers, publishers, and commerce media across CTV and mobile.
Security level
Good
Data confidenceMedium
Scope checked97.1%
A higher score means more observable Internet-facing protections were recorded; it is not proof that the website is legitimate, entirely safe, or free of vulnerabilities.
The first priority is “Session cookies protected from scripts (HttpOnly)”; review its evidence and recommendation before moving to lower-impact items. The provisional score is 84.5/100 with 97.1% coverage. It reflects only the parts of the attack surface with sufficient evidence.
Across 5 checked network reputation sources, CyStack did not find pubmatic.com or related infrastructure on a warning list. This does not verify the organization, its business practices, or guarantee that the website is completely safe.
The three issues to address first because they have the greatest security impact.
Check result
This check found a security issue.
Why it matters
HttpOnly prevents browser scripts from directly reading a cookie. It does not fix script injection, but it makes theft of session and authentication cookies more difficult.
What to do
Set HttpOnly on session and authentication cookies unless the application has a documented need to read them in browser code.
Recorded data
Compare the security level of each area at a glance.
Evidence in this report
A valid SSL certificate alone does not prove that pubmatic.com is safe or legitimate. For a fuller picture, this report also checks scam, phishing, and malware signals, exposed email records, IPs and open ports, subdomains, technologies, and CVEs that may apply to detected versions.
pubmatic.com presented a valid HTTPS certificate at assessment time, valid until November 22, 2026. This status can change when the certificate or server configuration is updated.
Review HTTPS and certificateThe available data contains 10 records associated with @pubmatic.com email addresses. Records may be old or already resolved, so they should be verified before passwords are reset or accounts are locked.
Data sources and scope
This scan result is compiled from CyStack's cybersecurity monitoring systems, including CyStack VulnScan and CyStack Threat Intelligence, together with publicly available Internet data. The assessment only observes and analyzes information already available; it does not attempt unauthorized access, test passwords, send exploit code, or change or disrupt your systems.
CyStack VulnScan for enterprises
CyStack VulnScan helps security teams automatically find Internet assets, scan external and internal systems, validate vulnerabilities and track remediation across the organization.
Check result
This check found a security issue.
Why it matters
The Secure attribute prevents a browser from sending a cookie over unencrypted HTTP. Without it, session or authentication data may be exposed to someone observing the network.
What to do
Set Secure on every session, authentication, and other sensitive cookie served by the HTTPS application.
Recorded data
Check result
This check found a security issue.
Why it matters
Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.
What to do
Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.
Recorded data
References
The complete list of issues to review, including the three priorities highlighted in the summary.
Check result
This check found a security issue.
Why it matters
HttpOnly prevents browser scripts from directly reading a cookie. It does not fix script injection, but it makes theft of session and authentication cookies more difficult.
What to do
Set HttpOnly on session and authentication cookies unless the application has a documented need to read them in browser code.
Recorded data
Check result
This check found a security issue.
Why it matters
The Secure attribute prevents a browser from sending a cookie over unencrypted HTTP. Without it, session or authentication data may be exposed to someone observing the network.
What to do
Set Secure on every session, authentication, and other sensitive cookie served by the HTTPS application.
Recorded data
Check result
This check found a security issue.
Why it matters
Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.
What to do
Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.
Recorded data
References
Check result
This check found a security issue.
Why it matters
Permissions-Policy controls whether this page and embedded content may use features such as the camera, microphone, and location. Leaving unused features available creates unnecessary access paths.
What to do
Allow each sensitive browser feature only for the pages and trusted origins that require it, and disable the rest.
Recorded data
References
Check result
This check found a security issue.
Why it matters
Exact web server or framework versions help attackers quickly look for known weaknesses that may apply. Hiding a version is not a substitute for patching, but unnecessary disclosure gives away useful targeting information.
What to do
Remove unnecessary version details from Server, X-Powered-By, error pages, and application metadata, and keep the software patched.
Recorded data
Check result
Found 12 potentially applicable CVE candidate(s), including 9 high or critical candidate(s).
Why it matters
The detected product and version were compared with vulnerability records from the National Vulnerability Database (NVD). A match is a lead, not confirmation: the installed software may include vendor fixes or may differ from the version visible on the Internet.
What to do
Confirm the exact installed package and read the vendor advisory. If that installation is affected, apply the vendor patch or upgrade to a fixed version.
Recorded data
Check result
The effective DMARC policy is none.
Why it matters
A policy of quarantine or reject tells receiving services to move suspicious mail to spam or refuse it. A monitoring-only policy (p=none) records the problem but does not ask receivers to stop spoofed mail.
What to do
After every legitimate sender passes DMARC, move gradually to quarantine and then reject, covering 100% of messages.
Recorded data
References
Check result
CyStack confirmed at least 163 active DNS subdomains. 22 names may expose sensitive services; discovery was partial, so more may exist.
Why it matters
Names containing admin, development, staging, VPN, database, or monitoring terms may point attackers toward valuable systems. A name alone does not prove exposure, but it identifies a surface that should be reviewed.
What to do
Remove obsolete DNS names and protect non-public systems with strong authentication, MFA, network allowlists, or a VPN.
Recorded data
Check result
10 email exposure records have an identity domain exactly matching this target and are associated with approximately 6 infected devices. These are intelligence observations; they do not prove that the email accounts are still active or that the devices belong to the organization.
Why it matters
Infostealer intelligence may contain credentials associated with the domain, but it does not prove that an account is current, valid, or still exposed.
What to do
Review the masked evidence and observation time, validate affected accounts and devices, then reset active credentials and sessions, enforce MFA, and remove malware where confirmed.
Recorded data
Check result
Found 0 applicable CAA record(s).
Why it matters
Certificate Authority Authorization (CAA) records state which certificate providers may issue certificates for the domain. This reduces the chance of an unintended provider issuing one.
What to do
Publish CAA records that allow only the certificate providers your organization actually uses.
References
Check result
No DNSSEC DS delegation was found.
Why it matters
DNSSEC adds digital signatures so resolvers can detect forged DNS answers. This quick check confirms the parent domain has a DS record, but it does not validate the complete signature chain.
What to do
Sign the DNS zone, publish the matching DS record through the registrar, and monitor the signature chain after key changes.
References
Check result
Known-exploited status remains inconclusive because version semantics did not support definitive CVE applicability.
Why it matters
A possible CVE match also appears in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means attackers have used that vulnerability in real incidents. The match is urgent to investigate, but the installed software still needs to be confirmed as affected.
What to do
Verify the installed product immediately and follow the CISA and vendor instructions for mitigation, patching, or upgrading if it is affected.
Recorded data
Check result
5 providers were definitive and 1 were inconclusive.
Why it matters
This shows how many independent blacklist services returned a clear result. A service that was unavailable was not checked successfully and must not be treated as a clean result.
Recorded data
Check result
The public homepage response revealed 17 technology item(s).
Why it matters
Response headers, page content, and other public clues suggest which technologies the service uses. These observations help explain the attack surface, but they can be incomplete or mistaken and do not by themselves confirm a vulnerability.
Recorded data
Check result
Passive response signals identified one or more WAF, CDN, or edge products; enforcement was not tested.
Why it matters
Public response details suggest that a Web Application Firewall (WAF), CDN, or other edge service is present. This quick scan identified the provider but did not test whether attack blocking is configured or working correctly.
Recorded data
Check result
Observed 3 versioned product(s); 1 had exact CPE mappings and 1 completed lookup(s).
Why it matters
This shows how many detected products had reliable version information and an exact CPE identity, allowing them to be checked against CVE applicability data. A product that could not be checked must not be treated as free of known vulnerabilities.
Recorded data
Check result
The certificate matches the requested target.
Why it matters
The certificate must list the exact hostname visitors requested in its Subject Alternative Names (SAN). A mismatch produces browser warnings because the certificate may belong to a different service.
What to do
Issue and deploy a certificate whose SAN list includes every public hostname served by this website address.
Recorded data
Check result
The certificate chains to a trusted root.
Why it matters
Browsers trust a website only when its certificate can be traced to a recognized certificate provider. An untrusted certificate causes warnings and prevents visitors from reliably confirming the website's identity.
What to do
Install a certificate from a provider trusted by common browsers and configure the server to send every required intermediate certificate.
Recorded data
Check result
A TLS handshake succeeded on port 443.
Why it matters
HTTPS encrypts data between visitors and the website and helps prove they reached the intended service. Without it, network observers may read or alter traffic and browsers may show a security warning.
What to do
Provide the entire website over HTTPS using a certificate trusted by common browsers.
Recorded data
Check result
The target resolved to 12 public IP address(es).
Why it matters
Public DNS connects the domain to its Internet addresses. Missing or incorrect records can make the service unreachable or send traffic to the wrong system.
What to do
Make sure the domain resolves only to its intended public IP addresses, and remove private, reserved, or outdated records.
Recorded data
Check result
No public management service was found on the scanned TCP port set.
Why it matters
Remote administration services such as RDP, VNC, Docker, Kubernetes, and management consoles are high-value targets. Public exposure allows anyone on the Internet to attempt passwords or exploit an unpatched service.
What to do
Remove direct Internet access and require a VPN, a hardened access gateway, or trusted source networks; also use MFA where supported.
Recorded data
Check result
No public datastore service was found on the scanned TCP port set.
Why it matters
Databases and caches often contain sensitive information and are normally used only by internal applications. Direct Internet access makes password attacks and configuration mistakes much more likely to become a data breach.
What to do
Listen only on private interfaces, allow connections only from required application systems, and require strong authentication and encryption.
Recorded data
Check result
No public file-sharing service was found on the scanned TCP port set.
Why it matters
Services such as SMB, NFS, and rsync can reveal or modify shared files and have a history of serious vulnerabilities. They rarely need to accept connections directly from the public Internet.
What to do
Limit file-sharing services to private networks or a tightly controlled VPN, and allow only the users and systems that require access.
Recorded data
Check result
No public legacy cleartext service was found on the scanned TCP port set.
Why it matters
Older services such as Telnet, FTP, and unencrypted mail or directory protocols can send passwords and data in readable form. Anyone able to observe the network path may capture them.
What to do
Disable the legacy service or replace it with an encrypted alternative such as SSH, SFTP, HTTPS, or the secure version of the mail protocol.
Recorded data
Check result
No issue was found by this check.
Why it matters
Cross-Origin Resource Sharing (CORS) decides which websites may read responses from this service in a visitor's browser. Rules that trust arbitrary origins, especially with login cookies, can expose private data to another website.
What to do
Allow only explicitly trusted websites, compare the Origin value with an exact approved list, and never allow login credentials with the wildcard origin (*).
Recorded data
Check result
The certificate is valid from 2025-10-23T00:00:00Z to 2026-11-21T23:59:59Z.
Why it matters
A certificate works only between its start and expiry dates. An expired, not-yet-valid, or soon-to-expire certificate can trigger browser warnings and interrupt access to the website or API.
What to do
Use automatic renewal, monitor renewal failures, and alert the responsible team well before expiry.
Recorded data
Check result
The certificate uses SHA256-RSA with a 2048-bit public key.
Why it matters
The certificate's public key and signature algorithm protect it from forgery. Keys that are too short or signatures based on obsolete algorithms provide less protection against modern attacks.
What to do
Use RSA with at least 2048 bits or a modern elliptic-curve key, and use SHA-256 or a stronger signature algorithm.
Recorded data
Check result
Accepted versions: TLS 1.3.
Why it matters
TLS 1.0 and TLS 1.1 use outdated security designs and are no longer accepted by modern standards. Leaving them enabled allows older, weaker connection methods.
What to do
Disable TLS 1.0 and TLS 1.1, support TLS 1.2 securely, and enable TLS 1.3 where possible.
Recorded data
References
Check result
No independent abuse-list consensus was found across 5 definitive providers.
Why it matters
Security and email providers maintain DNS-based blacklists of IP addresses associated with spam, malware, or compromised systems. Several current, independent listings are a strong reason to investigate, although a shared IP can sometimes affect unrelated customers.
What to do
Verify each listing against the affected IP, investigate mail and host activity, fix the underlying cause, and then follow the provider's removal process.
Recorded data
Check result
A DMARC policy was found.
Why it matters
DMARC lets the domain owner tell receiving services what to do when the visible From address is not verified by SPF or DKIM. Without DMARC, attackers have more opportunity to impersonate the domain in phishing email.
What to do
Publish a DMARC record at _dmarc, begin by collecting reports, and confirm that legitimate senders pass before applying a blocking policy.
Recorded data
References
Check result
The core DMARC policy tags passed structural validation.
Why it matters
Receiving services may ignore a DMARC record that contains duplicate fields, invalid values, or is published at the wrong DNS name. An ignored record provides no reliable protection from domain impersonation.
What to do
Publish one valid DMARC record at _dmarc and correct duplicate fields, unsupported values, and invalid report addresses.
References
Check result
The registration expires in 2971 day(s).
Why it matters
An expired domain stops directing users to the organization's services and may eventually become available to someone else. A domain close to expiry leaves little time to recover from payment or account problems.
What to do
Renew well before the expiry date, enable automatic renewal, and protect the payment method and registrar account.
Recorded data
Check result
RDAP returned 4 status value(s); 0 require attention.
Why it matters
Registrar or registry restrictions such as hold, redemption, or pending deletion can disable the domain. If they are not resolved, the organization may lose control of its website and email identity.
What to do
Resolve registration restrictions promptly, protect the registrar account with MFA, and keep ownership and contact information current.
Recorded data
Check result
No issue was found by this check.
Why it matters
SameSite limits when a browser includes cookies in requests started by another website. This helps prevent another site from silently making an authenticated request on a user's behalf.
What to do
Use SameSite=Lax or Strict by default. Use SameSite=None only for a required cross-site flow and always combine it with Secure.
Recorded data
Check result
No issue was found by this check.
Why it matters
Another website can place this page inside a hidden or misleading frame and trick a user into clicking an unintended action. Frame restrictions tell browsers which sites, if any, may embed the page.
What to do
Set frame-ancestors in CSP to the required trusted sites, and keep X-Frame-Options for older browsers when appropriate.
Recorded data
References
Check result
No issue was found by this check.
Why it matters
An HTTPS page can still load scripts, frames, styles, or forms over unencrypted HTTP. An attacker on the network may alter that content and compromise the otherwise secure page.
What to do
Load every script, frame, stylesheet, and form destination over HTTPS, and remove or replace resources that do not support it.
Recorded data
Check result
No issue was found by this check.
Why it matters
Without the nosniff setting, a browser may guess a file's type and treat harmless-looking content as executable code. This can turn an incorrect Content-Type into a security issue.
What to do
Send X-Content-Type-Options: nosniff on every response and return an accurate Content-Type.
Recorded data
References
Check result
The server presented 3 certificate(s).
Why it matters
The server must provide the intermediate certificates that connect its website certificate to a trusted provider. If any are missing, some browsers, mobile devices, or API clients may reject the connection.
What to do
Configure the server to send the website certificate followed by every required intermediate certificate, but not the root certificate.
Recorded data
Check result
The HTTPS response enables HSTS.
Why it matters
HTTP Strict Transport Security (HSTS) tells a browser to use HTTPS automatically on future visits. This reduces the chance that a visitor is downgraded to an unencrypted connection.
What to do
After confirming that every required page works over HTTPS, send the Strict-Transport-Security header on all HTTPS responses.
Recorded data
Check result
The HTTP root redirects to HTTPS within the target domain.
Why it matters
Visitors may enter an address beginning with HTTP or follow an old link. Redirecting them immediately to HTTPS prevents the rest of the visit from continuing over an unencrypted connection.
What to do
Redirect every HTTP URL directly to its corresponding HTTPS URL without passing through another HTTP address.
Recorded data
Check result
The root page did not match a common automatic directory-index pattern.
Why it matters
When a web server automatically lists a directory, visitors may discover files that were never linked publicly, including backups, logs, or deployment artifacts.
What to do
Disable automatic directory indexes unless public file browsing is an intentional feature, and remove sensitive files from web-accessible folders.
Recorded data
Check result
The terminal SPF policy is -all.
Why it matters
The final SPF rule tells receiving services how confidently they should reject unlisted senders. A permissive result allows more spoofed mail to appear legitimate than a hard fail (-all).
What to do
Confirm that every legitimate sender is included, then end the SPF record with -all.
Recorded data
References
Check result
An SPF record was found.
Why it matters
Sender Policy Framework (SPF) lists the systems allowed to send email for the domain. Without it, receiving services have less evidence to distinguish legitimate mail from spoofed mail.
What to do
Publish one SPF TXT record that includes every legitimate email service and no unauthorized sender.
Recorded data
References
Check result
The SPF record passed structural validation.
Why it matters
More than one SPF record, invalid terms, or too many DNS lookups can make SPF return a permanent error. Receiving services may then be unable to verify authorized senders.
What to do
Keep one valid SPF record, remove invalid terms, and remain within the SPF limit of ten DNS-based lookups.
Recorded data
References
Check result
Found 1 MX record(s); 0 target(s) were invalid.
Why it matters
MX records direct incoming email to the correct mail servers. Broken records can stop delivery, while a Null MX clearly tells senders that the domain does not receive email.
What to do
Correct unreachable or outdated MX hosts, or publish a Null MX if the domain is not intended to receive email.
Recorded data
Check result
No public unexpected service was found on the scanned TCP port set.
Why it matters
Every open service can be discovered and attacked and must be configured, monitored, and patched. Services without a clear public purpose add risk without providing business value.
What to do
Confirm the owner and purpose of every open port, then stop or firewall any service that is not intentionally public.
Recorded data
Check result
No issue was found by this check.
Why it matters
When a visitor follows a link, the browser may send the previous page's URL to the destination. Paths and query values in that URL can reveal sensitive context to another website.
What to do
Use strict-origin-when-cross-origin or a stricter Referrer-Policy, and avoid placing secrets in URLs.
Recorded data
References
Check result
The HSTS max-age is at least 180 days.
Why it matters
The max-age value controls how long browsers remember to use HTTPS. A very short period provides limited protection, while includeSubDomains also covers every subdomain and can break one that does not support HTTPS.
What to do
Use a long max-age, and add includeSubDomains only after confirming that every active subdomain works correctly over HTTPS.
Recorded data
Check result
Aggregate reporting is configured.
Why it matters
DMARC aggregate reports show which systems send email using the domain and which messages fail verification. They help find both impersonation attempts and legitimate services that need correction.
What to do
Add an aggregate report address (rua) that is protected and monitored, or use a trusted DMARC reporting service.
Recorded data
References
Check result
Found 1 MX record(s); 0 target(s) were invalid.
Why it matters
A domain should clearly state whether it receives email. Without valid MX records or a Null MX, senders may try an unintended server and delivery behavior becomes unpredictable.
What to do
Publish valid MX records for the intended mail servers, or a Null MX if the domain never accepts email.
Recorded data
Check result
Found 4 authoritative name server(s).
Why it matters
Authoritative name servers tell visitors where the domain is hosted. Depending on only one server creates a single point of failure for the website and email.
What to do
Use at least two authoritative name servers, preferably on independent and resilient infrastructure.
Recorded data
Check result
This check does not apply to the target.
Why it matters
If either a password page or the address receiving its form uses HTTP, someone observing the network may read or change the submitted password.
What to do
Serve every page containing a password field over HTTPS and submit each password form directly to an HTTPS address.
Recorded data
Addresses, servers and services that are visible from the Internet.
Each public IP is grouped with its open services, identified products and any CVEs that may apply to the observed version.
Amazon CloudfrontC
Check whether the website uses a secure connection and whether its HTTPS certificate remains valid.
Identify website protection and check whether public IPs appear on warning lists.
AWSCheck domain and email settings that help prevent brand impersonation.
These matching email records were observed previously, but they may already have been addressed or may no longer be valid. The device count estimates infected devices associated with these email records; it is not the number of devices owned by the organization.
Most recent observation:
Shows up to 10 recent matching email records. Each row connects a masked email address with its related infected-device indicator (IOC). Passwords, access tokens and original IOC identifiers are never shown.
IOC-31E9B979F2At most 10 recent redacted records are shown to protect sensitive information.
Data provided by CyStack Threat Intelligence.
This is a quick, point-in-time check from outside the organization. It can surface visible risks, but it does not replace penetration testing or an authenticated assessment.
The assessment identified 62 technologies on pubmatic.com, including 6 with a version, and found 12 CVEs that may apply. Each result needs version and configuration validation before it is treated as a confirmed vulnerability.
Review technologies and CVEsThe assessment observed 8 public IPs and 8 open ports for pubmatic.com; the infrastructure appears to be operated by Amazon.com, Inc., Amazon AWS. An open port is not automatically a vulnerability, but every public service should be updated and appropriately restricted.
Review IPs and open portsThe assessment observed 163+ public subdomains of pubmatic.com. This inventory can reveal additional entry points such as APIs, administration systems, or test environments, but it does not imply that every subdomain is risky.
Review discovered subdomainsReferences
References
Amazon CloudfrontVersion not visibleCloudFront Load BalancerVersion not visible
PHPAAmazon CloudFrontA
Amazon Web Services+1812 potential CVEsPHPProgramming Languages8.3.2312 potential CVEsCVSS 9.8PHP is a general-purpose scripting language used for web development.
php.netPotential CVEs for this product
Amazon CloudfrontCCloudFront Load BalancerAmazon CloudfrontVersion not visibleCloudFront Load BalancerVersion not visiblePHPAAmazon CloudFrontAAmazon Web Services+1712 potential CVEsPHPAmazon CloudfrontCCloudFront Load BalancerAmazon CloudfrontVersion not visibleCloudFront Load BalancerVersion not visiblePHPAAmazon CloudFrontAAmazon Web Services+1712 potential CVEsPHPAmazon CloudfrontCCloudFront Load BalancerAmazon CloudfrontVersion not visibleCloudFront Load BalancerVersion not visiblePHPAAmazon CloudFrontAAmazon Web Services+1712 potential CVEsPHPNo open service was observed on this address in the ports checked.
No open service was observed on this address in the ports checked.
No open service was observed on this address in the ports checked.
No open service was observed on this address in the ports checked.
IOC-DF6D5BD6E3IOC-FA8E646E71IOC-447EC9F91DIOC-E1FAE9E487IOC-E1FAE9E487IOC-E1FAE9E487IOC-5F7F64EBC6IOC-5F7F64EBC6In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
NvdIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
NvdIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
NvdIn PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
NvdIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
NvdAmazon CloudFrontCDNVersion not visibleAmazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.
aws.amazon.com/cloudfrontAmazon Web ServicesPaaSVersion not visibleAmazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.
aws.amazon.com
BootstrapUI FrameworksVersion not visibleBootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.
getbootstrap.com
CaddyWeb ServersVersion not visible
cdnjsCDNVersion not visiblecdnjs is a free distributed JS library delivery service.
cdnjs.com
CloudflareCDNVersion not visibleCloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
www.cloudflare.com
Google Tag ManagerTag ManagersVersion not visibleGoogle Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.
www.google.com/tagmanager
HSTSSecurityVersion not visibleHTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
www.rfc-editor.org/rfc/rfc6797#section-6.1
HTTP/3MiscellaneousVersion not visibleHTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.
httpwg.org
jQueryJavaScript LibrariesVersion not visiblejQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
jquery.com
MysqlDatabasesVersion not visibleMySQL is an open-source relational database management system.
mysql.comMySQLDatabasesVersion not visibleMySQL is an open-source relational database management system.
mysql.com
SlickJavaScript LibrariesVersion not visible
waitForImagesJavaScript LibrariesVersion not visiblewaitForImages is a lightweight, high-performance JavaScript library that simplifies the handling of image preloading events.
github.com/alexanderdickson/waitForImages
WordPressBlogs · CMSVersion not visibleWordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
wordpress.org
Yoast SEOSEO · WordPress Plugins27.6Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.
yoast.com/wordpress/plugins/seoYoast SEO PremiumSEO27.6Yoast SEO Premium is a search engine optimisation plugin for WordPress and other platforms.
yoast.com/wordpress/plugins/seo
PardotWordpress Plugin6.9.5
Post Views CounterWordpress Plugin1.7.10
PubmaticWordpress Theme5.3.3PHP is a general-purpose scripting language used for web development.
php.netPotential CVEs for this product
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
NvdIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
NvdIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
NvdIn PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
NvdIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
NvdAmazon CloudFrontCDNVersion not visibleAmazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.
aws.amazon.com/cloudfrontAmazon Web ServicesPaaSVersion not visibleAmazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.
aws.amazon.comBootstrapUI FrameworksVersion not visibleBootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.
getbootstrap.comCaddyWeb ServersVersion not visiblecdnjsCDNVersion not visiblecdnjs is a free distributed JS library delivery service.
cdnjs.comCloudflareCDNVersion not visibleCloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
www.cloudflare.comGoogle Tag ManagerTag ManagersVersion not visibleGoogle Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.
www.google.com/tagmanagerHSTSSecurityVersion not visibleHTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
www.rfc-editor.org/rfc/rfc6797#section-6.1HTTP/3MiscellaneousVersion not visibleHTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.
httpwg.orgjQueryJavaScript LibrariesVersion not visiblejQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
jquery.comMysqlDatabasesVersion not visibleMySQL is an open-source relational database management system.
mysql.comSlickJavaScript LibrariesVersion not visiblewaitForImagesJavaScript LibrariesVersion not visiblewaitForImages is a lightweight, high-performance JavaScript library that simplifies the handling of image preloading events.
github.com/alexanderdickson/waitForImagesWordPressBlogs · CMSVersion not visibleWordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
wordpress.orgYoast SEOSEO · WordPress Plugins27.6Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.
yoast.com/wordpress/plugins/seoYoast SEO PremiumSEO27.6Yoast SEO Premium is a search engine optimisation plugin for WordPress and other platforms.
yoast.com/wordpress/plugins/seoPardotWordpress Plugin6.9.5Post Views CounterWordpress Plugin1.7.10PubmaticWordpress Theme5.3.3PHP is a general-purpose scripting language used for web development.
php.netPotential CVEs for this product
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
NvdIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
NvdIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
NvdIn PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
NvdIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
NvdAmazon CloudFrontCDNVersion not visibleAmazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.
aws.amazon.com/cloudfrontAmazon Web ServicesPaaSVersion not visibleAmazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.
aws.amazon.comBootstrapUI FrameworksVersion not visibleBootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.
getbootstrap.comCaddyWeb ServersVersion not visiblecdnjsCDNVersion not visiblecdnjs is a free distributed JS library delivery service.
cdnjs.comCloudflareCDNVersion not visibleCloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
www.cloudflare.comGoogle Tag ManagerTag ManagersVersion not visibleGoogle Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.
www.google.com/tagmanagerHSTSSecurityVersion not visibleHTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
www.rfc-editor.org/rfc/rfc6797#section-6.1HTTP/3MiscellaneousVersion not visibleHTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.
httpwg.orgjQueryJavaScript LibrariesVersion not visiblejQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
jquery.comMysqlDatabasesVersion not visibleMySQL is an open-source relational database management system.
mysql.comSlickJavaScript LibrariesVersion not visiblewaitForImagesJavaScript LibrariesVersion not visiblewaitForImages is a lightweight, high-performance JavaScript library that simplifies the handling of image preloading events.
github.com/alexanderdickson/waitForImagesWordPressBlogs · CMSVersion not visibleWordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
wordpress.orgYoast SEOSEO · WordPress Plugins27.6Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.
yoast.com/wordpress/plugins/seoYoast SEO PremiumSEO27.6Yoast SEO Premium is a search engine optimisation plugin for WordPress and other platforms.
yoast.com/wordpress/plugins/seoPardotWordpress Plugin6.9.5Post Views CounterWordpress Plugin1.7.10PubmaticWordpress Theme5.3.3PHP is a general-purpose scripting language used for web development.
php.netPotential CVEs for this product
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without incrementing their reference counts. When an apache:Map node contains duplicate keys, processing the second entry overwrites the first in the temporary result map, freeing the original PHP object while its stale pointer remains in the map. A subsequent href reference to the freed node can copy the dangling pointer into the result. As PHP string allocations can reclaim the freed memory region, an attacker with control over the SOAP request body can exploit this use-after-free to achieve remote code execution.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via session storage. However, in the case SOAP requests results in an error, the persistance is handled incorrectly, resulting in freeing the object while keeping a pointer to it, which may lead to use-after-free. This may lead to memory corruption, information disclosure, or process crashes, with confidentiality, integrity, and availability impact on the vulnerable system.
NvdIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_merge() when the total element count of packed arrays exceeds 32-bit limits or HT_MAX_SIZE, due to an integer overflow in the precomputation of element counts using zend_hash_num_elements(). This may lead to memory corruption or crashes and affect the integrity and availability of the target server.
NvdIn PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, the getimagesize() function may leak uninitialized heap memory into the APPn segments (e.g., APP1) when reading images in multi-chunk mode (such as via php://filter). This occurs due to a bug in php_read_stream_all_chunks() that overwrites the buffer without advancing the pointer, leaving tail bytes uninitialized. This may lead to information disclosure of sensitive heap data and affect the confidentiality of the target server.
NvdIn PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, some functions, including urldecode(), pass signed char to ctype functions (like isxdigit()). On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can lead to accessing array with negative offset, which can trigger a denial of service.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element. This leads to dereferences a NULL pointer, causing a segmentation fault. This allows a remote unauthenticated attacker to crash the PHP SOAP server process, resulting in denial of service.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed integer overflow occurs, resulting in undefined behavior. This can lead to an out-of-bounds read, causing a segmentation fault or access to unrelated memory, and may affect the availability of the PHP process.
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, a mismatch between encoding lists in Oniguruma and mbfl leads to a NULL pointer dereference, resulting in a segmentation fault and denial of service. The vulnerability is exploitable when user-controlled input can influence the encoding passed to mb_regex_encoding().
NvdIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
NvdIn PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the plaintext length without accounting for RFC 5649 expansion. This may cause OpenSSL to write beyond allocated memory, corrupting heap metadata and triggering application abort.
NvdAmazon CloudFrontCDNVersion not visibleAmazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.
aws.amazon.com/cloudfrontAmazon Web ServicesPaaSVersion not visibleAmazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.
aws.amazon.comBootstrapUI FrameworksVersion not visibleBootstrap is a free and open-source CSS framework directed at responsive, mobile-first front-end web development. It contains CSS and JavaScript-based design templates for typography, forms, buttons, navigation, and other interface components.
getbootstrap.comCaddyWeb ServersVersion not visiblecdnjsCDNVersion not visiblecdnjs is a free distributed JS library delivery service.
cdnjs.comCloudflareCDNVersion not visibleCloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
www.cloudflare.comGoogle Tag ManagerTag ManagersVersion not visibleGoogle Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.
www.google.com/tagmanagerHSTSSecurityVersion not visibleHTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.
www.rfc-editor.org/rfc/rfc6797#section-6.1HTTP/3MiscellaneousVersion not visibleHTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.
httpwg.orgjQueryJavaScript LibrariesVersion not visiblejQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
jquery.comMysqlDatabasesVersion not visibleMySQL is an open-source relational database management system.
mysql.comSlickJavaScript LibrariesVersion not visiblewaitForImagesJavaScript LibrariesVersion not visiblewaitForImages is a lightweight, high-performance JavaScript library that simplifies the handling of image preloading events.
github.com/alexanderdickson/waitForImagesWordPressBlogs · CMSVersion not visibleWordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. Features include a plugin architecture and a template system.
wordpress.orgYoast SEOSEO · WordPress Plugins27.6Yoast SEO is a search engine optimisation plugin for WordPress and other platforms.
yoast.com/wordpress/plugins/seoYoast SEO PremiumSEO27.6Yoast SEO Premium is a search engine optimisation plugin for WordPress and other platforms.
yoast.com/wordpress/plugins/seoPardotWordpress Plugin6.9.5Post Views CounterWordpress Plugin1.7.10PubmaticWordpress Theme5.3.3Recently completed assessments, prioritizing websites with a similar sector, country or security grade for easier comparison.
