In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
CVSS Details
- CVSS 4.0 Base Score: 7.3 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:Amber)
- CVSS 3.1 Base Score: 6.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade php-intlUpgrade php-dbaUpgrade phpUpgrade php-pecl-rrdUpgrade php-processUpgrade apcu-panelUpgrade php-opcacheUpgrade php-ffiUpgrade php-odbcUpgrade php-mysqlndUpgrade php-snmpUpgrade libzip-develUpgrade libzip-toolsUpgrade php-cliUpgrade php-commonUpgrade php-embeddedUpgrade php-pecl-xdebug3Upgrade php-pecl-xdebugUpgrade php-jsonUpgrade php-pgsqlUpgrade php-xmlUpgrade php-dbgUpgrade php-develUpgrade php-xmlrpcUpgrade php-pecl-redis6Upgrade libzipUpgrade php-enchantUpgrade php-pdoUpgrade php-gmpUpgrade php-pearUpgrade php-pecl-apcuUpgrade php-mbstringUpgrade php-gdUpgrade php-ldapUpgrade php-fpmUpgrade php-bcmathUpgrade php-soapUpgrade php-pecl-apcu-develUpgrade php-pecl-zip | Jun 1, 2026 | Jun 1, 2026 |
| Alpine Linux | — | Upgrade php83Upgrade php81Upgrade php82Upgrade php84Upgrade php85 | May 15, 2026 | May 10, 2026 |
| Amazon Linux Ami 2 | — | Upgrade php-dbgUpgrade php-soapUpgrade php-odbcUpgrade phpUpgrade php-sodiumUpgrade php-ldapUpgrade php-intlUpgrade php-dbaUpgrade php-commonUpgrade php-pgsqlUpgrade php-bcmathUpgrade php-pdoUpgrade php-mbstringUpgrade php-enchantUpgrade php-mysqlndUpgrade php-pspellUpgrade php-gdUpgrade php-develUpgrade php-fpmUpgrade php-embeddedUpgrade php-cliUpgrade php-opcacheUpgrade php-xmlUpgrade php-debuginfoUpgrade php-processUpgrade php-snmpUpgrade php-gmp | Jun 8, 2026 | Jun 8, 2026 |
| Amazon_linux_2023 | — | Upgrade php8.3-enchantUpgrade php8.3-soap-debuginfoUpgrade php8.5-process-debuginfoUpgrade php8.3-develUpgrade php8.4-ffiUpgrade php8.4-debugsourceUpgrade php8.4-bcmathUpgrade php8.3-embedded-debuginfoUpgrade php8.2-opcache-debuginfoUpgrade php8.2-ldapUpgrade php8.5-bcmathUpgrade php8.4-gdUpgrade php8.2-pdo-debuginfoUpgrade php8.3-ldapUpgrade php8.5-pdo-debuginfoUpgrade php8.5-pdoUpgrade php8.5-gmpUpgrade php8.5-cli-debuginfoUpgrade php8.5Upgrade php8.4-xmlUpgrade php8.4-pdo-debuginfoUpgrade php8.4-dba-debuginfoUpgrade php8.3-gdUpgrade php8.3-odbc-debuginfoUpgrade php8.3-cliUpgrade php8.2-zip-debuginfoUpgrade php8.3-soapUpgrade php8.3-pspell-debuginfoUpgrade php8.2-pspell-debuginfoUpgrade php8.3-xml-debuginfoUpgrade php8.2-ffiUpgrade php8.5-dbaUpgrade php8.5-gdUpgrade php8.4-debuginfoUpgrade php8.3-ffiUpgrade php8.3-bcmathUpgrade php8.2-processUpgrade php8.2-fpm-debuginfoUpgrade php8.2-ffi-debuginfoUpgrade php8.5-snmp-debuginfoUpgrade php8.5-intlUpgrade php8.2-debugsourceUpgrade php8.5-xmlUpgrade php8.5-gmp-debuginfoUpgrade php8.5-ffi-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php8.2-intlUpgrade php8.4-gmp-debuginfoUpgrade php8.4-ldapUpgrade php8.5-commonUpgrade php8.4-odbcUpgrade php8.4-mbstring-debuginfoUpgrade php8.3-snmp-debuginfoUpgrade php8.5-processUpgrade php8.5-debugsourceUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.3-dba-debuginfoUpgrade php8.3-sodium-debuginfoUpgrade php8.3-opcacheUpgrade php8.4-dbaUpgrade php8.3-common-debuginfoUpgrade php8.5-zipUpgrade php8.4-modphp-debuginfoUpgrade php8.3-bcmath-debuginfoUpgrade php8.3-pgsqlUpgrade php8.3-tidyUpgrade php8.2-sodiumUpgrade php8.2-odbc-debuginfoUpgrade php8.4-processUpgrade php8.4-dbgUpgrade php8.5-mysqlnd-debuginfoUpgrade php8.2-odbcUpgrade php8.4-intlUpgrade php8.3-cli-debuginfoUpgrade php8.2-zipUpgrade php8.2Upgrade php8.3Upgrade php8.2-snmpUpgrade php8.2-pgsql-debuginfoUpgrade php8.2-pdoUpgrade php8.2-mysqlndUpgrade php8.2-gdUpgrade php8.2-bcmathUpgrade php8.5-modphp-debuginfoUpgrade php8.5-mbstringUpgrade php8.5-cliUpgrade php8.4-commonUpgrade php8.4-bcmath-debuginfoUpgrade php8.3-odbcUpgrade php8.3-pgsql-debuginfoUpgrade php8.3-xmlUpgrade php8.3-pspellUpgrade php8.2-gd-debuginfoUpgrade php8.2-dbg-debuginfoUpgrade php8.2-dbaUpgrade php8.2-cliUpgrade php8.5-intl-debuginfoUpgrade php8.5-common-debuginfoUpgrade php8.4-snmpUpgrade php8.4-fpm-debuginfoUpgrade php8.4-zipUpgrade php8.3-zip-debuginfoUpgrade php8.3-process-debuginfoUpgrade php8.2-pspellUpgrade php8.3-dbgUpgrade php8.3-pdoUpgrade php8.2-commonUpgrade php8.5-modphpUpgrade php8.5-ffiUpgrade php8.5-enchantUpgrade php8.5-debuginfoUpgrade php8.5-mbstring-debuginfoUpgrade php8.2-opcacheUpgrade php8.5-ldapUpgrade php8.2-tidyUpgrade php8.3-debuginfoUpgrade php8.2-soap-debuginfoUpgrade php8.5-tidy-debuginfoUpgrade php8.5-develUpgrade php8.5-dbg-debuginfoUpgrade php8.2-embeddedUpgrade php8.4-pgsql-debuginfoUpgrade php8.2-dbgUpgrade php8.2-sodium-debuginfoUpgrade php8.2-gmpUpgrade php8.4-fpmUpgrade php8.4-process-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php8.4-cli-debuginfoUpgrade php8.2-xml-debuginfoUpgrade php8.2-ldap-debuginfoUpgrade php8.3-tidy-debuginfoUpgrade php8.3-modphp-debuginfoUpgrade php8.3-zipUpgrade php8.2-process-debuginfoUpgrade php8.2-mbstringUpgrade php8.2-fpmUpgrade php8.5-tidyUpgrade php8.5-pgsqlUpgrade php8.4-modphpUpgrade php8.4-gmpUpgrade php8.4-enchantUpgrade php8.3-pdo-debuginfoUpgrade php8.3-opcache-debuginfoUpgrade php8.3-mysqlndUpgrade php8.3-intl-debuginfoUpgrade php8.2-develUpgrade php8.5-sodiumUpgrade php8.5-fpmUpgrade php8.3-sodiumUpgrade php8.3-modphpUpgrade php8.4-dbg-debuginfoUpgrade php8.5-bcmath-debuginfoUpgrade php8.4-tidy-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php8.2-tidy-debuginfoUpgrade php8.2-cli-debuginfoUpgrade php8.2-xmlUpgrade php8.4-sodiumUpgrade php8.5-snmpUpgrade php8.4-soapUpgrade php8.4Upgrade php8.2-enchantUpgrade php8.4-pdoUpgrade php8.5-sodium-debuginfoUpgrade php8.5-pgsql-debuginfoUpgrade php8.5-odbcUpgrade php8.5-dbgUpgrade php8.4-tidyUpgrade php8.4-pgsqlUpgrade php8.4-ffi-debuginfoUpgrade php8.4-embeddedUpgrade php8.3-intlUpgrade php8.3-gd-debuginfoUpgrade php8.2-snmp-debuginfoUpgrade php8.2-mysqlnd-debuginfoUpgrade php8.2-debuginfoUpgrade php8.3-gmp-debuginfoUpgrade php8.4-gd-debuginfoUpgrade php8.4-intl-debuginfoUpgrade php8.3-embeddedUpgrade php8.2-soapUpgrade php8.2-enchant-debuginfoUpgrade php8.2-embedded-debuginfoUpgrade php8.5-zip-debuginfoUpgrade php8.5-ldap-debuginfoUpgrade php8.5-embeddedUpgrade php8.5-dba-debuginfoUpgrade php8.4-zip-debuginfoUpgrade php8.4-mysqlndUpgrade php8.2-pgsqlUpgrade php8.5-soap-debuginfoUpgrade php8.2-bcmath-debuginfoUpgrade php8.4-odbc-debuginfoUpgrade php8.4-mbstringUpgrade php8.4-ldap-debuginfoUpgrade php8.4-enchant-debuginfoUpgrade php8.4-cliUpgrade php8.3-mbstring-debuginfoUpgrade php8.3-mbstringUpgrade php8.3-debugsourceUpgrade php8.2-mbstring-debuginfoUpgrade php8.2-common-debuginfoUpgrade php8.3-gmpUpgrade php8.3-fpm-debuginfoUpgrade php8.4-sodium-debuginfoUpgrade php8.4-common-debuginfoUpgrade php8.3-processUpgrade php8.3-ffi-debuginfoUpgrade php8.2-gmp-debuginfoUpgrade php8.2-dba-debuginfoUpgrade php8.5-xml-debuginfoUpgrade php8.5-gd-debuginfoUpgrade php8.5-soapUpgrade php8.4-snmp-debuginfoUpgrade php8.5-fpm-debuginfoUpgrade php8.5-embedded-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php8.4-opcacheUpgrade php8.3-snmpUpgrade php8.3-mysqlnd-debuginfoUpgrade php8.3-fpmUpgrade php8.3-dbaUpgrade php8.3-commonUpgrade php8.3-ldap-debuginfoUpgrade php8.3-enchant-debuginfoUpgrade php8.5-mysqlndUpgrade php8.4-develUpgrade php8.5-odbc-debuginfoUpgrade php8.2-intl-debuginfoUpgrade php8.3-dbg-debuginfoUpgrade php8.5-enchant-debuginfo | May 28, 2026 | May 10, 2026 |
| Debian | — | Upgrade php8.4Upgrade php7.4Upgrade php8.2 | May 10, 2026 | May 10, 2026 |
| Oracle_linux | — | Upgrade php-ffiUpgrade php-processUpgrade php-mbstringUpgrade libzip-develUpgrade php-snmpUpgrade php-soapUpgrade php-dbaUpgrade libzip-toolsUpgrade php-pecl-rrdUpgrade php-gdUpgrade php-embeddedUpgrade php-ldapUpgrade php-pecl-apcu-develUpgrade php-mysqlndUpgrade php-enchantUpgrade php-gmpUpgrade apcu-panelUpgrade php-develUpgrade php-bcmathUpgrade php-pearUpgrade php-pecl-zipUpgrade php-xmlUpgrade php-pecl-xdebug3Upgrade php-dbgUpgrade php-odbcUpgrade php-pecl-apcuUpgrade php-pdoUpgrade php-commonUpgrade php-intlUpgrade php-fpmUpgrade php-cliUpgrade phpUpgrade libzipUpgrade php-opcacheUpgrade php-pgsql | Jun 4, 2026 | May 10, 2026 |
| Redhat_linux | — | Upgrade php-pecl-zip-debuginfoUpgrade php8.4-mbstringUpgrade php-fpm-debuginfoUpgrade libzip-debuginfoUpgrade php-processUpgrade libzip-tools-debuginfoUpgrade php-ffiUpgrade php8.4-intlUpgrade php8.4-embeddedUpgrade php-gmpUpgrade php-odbc-debuginfoUpgrade php-commonUpgrade php8.4-fpmUpgrade php-pecl-redis6-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-dbgUpgrade libzipUpgrade php-pgsql-debuginfoUpgrade php-process-debuginfoUpgrade php-pdoUpgrade php8.4Upgrade php8.4-ldap-debuginfoUpgrade php-ldap-debuginfoUpgrade php8.4-process-debuginfoUpgrade php-ldapUpgrade php-json-debuginfoUpgrade php-soapUpgrade libzip-debugsourceUpgrade php-mbstring-debuginfoUpgrade php-mysqlnd-debuginfoUpgrade php-dbaUpgrade php8.4-enchant-debuginfoUpgrade php-gmp-debuginfoUpgrade php8.4-embedded-debuginfoUpgrade php-pecl-redis6-debugsourceUpgrade libzip-toolsUpgrade php-pgsqlUpgrade php8.4-common-debuginfoUpgrade php-pecl-xdebug3-debugsourceUpgrade php8.4-cli-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade apcu-panelUpgrade php-intlUpgrade php-jsonUpgrade php-gdUpgrade php-pecl-rrdUpgrade phpUpgrade php-cli-debuginfoUpgrade php-ffi-debuginfoUpgrade php-snmp-debuginfoUpgrade php-xml-debuginfoUpgrade php8.4-opcacheUpgrade php-pecl-zipUpgrade php8.4-pdoUpgrade php-odbcUpgrade php-bcmath-debuginfoUpgrade php8.4-dbg-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php8.4-pgsqlUpgrade php-dba-debuginfoUpgrade php8.4-develUpgrade php-pecl-xdebug-debugsourceUpgrade php8.4-debugsourceUpgrade php-pecl-apcu-develUpgrade php-pdo-debuginfoUpgrade php8.4-odbcUpgrade php8.4-intl-debuginfoUpgrade php-xmlrpcUpgrade php-fpmUpgrade php-debuginfoUpgrade php8.4-gmpUpgrade php-embeddedUpgrade php8.4-pgsql-debuginfoUpgrade php-dbg-debuginfoUpgrade php-opcache-debuginfoUpgrade php8.4-pdo-debuginfoNo solution existsUpgrade php8.4-mysqlndUpgrade php-pecl-xdebug-debuginfoUpgrade php-soap-debuginfoUpgrade php-bcmathUpgrade php8.4-bcmathUpgrade php8.4-cliUpgrade php-xmlUpgrade php-pecl-xdebug3Upgrade php-opcacheUpgrade php8.4-gd-debuginfoUpgrade php8.4-dbaUpgrade php-cliUpgrade libzip-develUpgrade php8.4-xmlUpgrade php-develUpgrade php8.4-dba-debuginfoUpgrade php-intl-debuginfoUpgrade php-pecl-redis6Upgrade php-pecl-xdebugUpgrade php8.4-ldapUpgrade php-pecl-apcu-debuginfoUpgrade php-pecl-rrd-debugsourceUpgrade php8.4-ffi-debuginfoUpgrade php-gd-debuginfoUpgrade php-pecl-rrd-debuginfoUpgrade php8.4-mbstring-debuginfoUpgrade php8.4-snmp-debuginfoUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-odbc-debuginfoUpgrade php-mbstringUpgrade php8.4-dbgUpgrade php8.4-debuginfoUpgrade php8.4-processUpgrade php8.4-gdUpgrade php8.4-commonUpgrade php-pecl-apcuUpgrade php-enchantUpgrade php-debugsourceUpgrade php8.4-snmpUpgrade php-snmpUpgrade php8.4-bcmath-debuginfoUpgrade php-pecl-xdebug3-debuginfoUpgrade php-pearUpgrade php-enchant-debuginfoUpgrade php-embedded-debuginfoUpgrade php8.4-gmp-debuginfoUpgrade php8.4-ffiUpgrade php8.4-enchantUpgrade php8.4-soapUpgrade php-mysqlndUpgrade php-common-debuginfoUpgrade php-pecl-zip-debugsourceUpgrade php8.4-soap-debuginfo | Jun 3, 2026 | May 10, 2026 |
| Rocky_linux | — | Upgrade php8.4-enchant-debuginfoUpgrade php-pdo-debuginfoUpgrade libzip-develUpgrade php-processUpgrade php-soapUpgrade php-pecl-rrd-debuginfoUpgrade php8.4Upgrade php8.4-snmp-debuginfoUpgrade libzip-toolsUpgrade php8.4-embedded-debuginfoUpgrade php8.4-fpm-debuginfoUpgrade php8.4-snmpUpgrade php-ldap-debuginfoUpgrade php-opcache-debuginfoUpgrade php-gdUpgrade php8.4-dba-debuginfoUpgrade php8.4-processUpgrade php-process-debuginfoUpgrade php8.4-develUpgrade php8.4-enchantUpgrade php-pecl-redis6-debugsourceUpgrade php-mbstringUpgrade php-mysqlnd-debuginfoUpgrade php-dbaUpgrade php-pgsql-debuginfoUpgrade php8.4-commonUpgrade php8.4-opcacheUpgrade php8.4-gmpUpgrade php-bcmath-debuginfoUpgrade php8.4-gmp-debuginfoUpgrade php8.4-ldap-debuginfoUpgrade php-pecl-rrdUpgrade php8.4-pdo-debuginfoUpgrade php-pecl-apcu-debuginfoUpgrade php8.4-bcmathUpgrade php8.4-pdoUpgrade php-cli-debuginfoUpgrade php-debuginfoUpgrade php8.4-dbaUpgrade php8.4-pgsqlUpgrade php8.4-ffi-debuginfoUpgrade php-ffiUpgrade php8.4-dbgUpgrade php8.4-mysqlndUpgrade php-pecl-redis6-debuginfoUpgrade php8.4-xml-debuginfoUpgrade php8.4-soap-debuginfoUpgrade php-soap-debuginfoUpgrade php-snmpUpgrade libzip-debugsourceUpgrade php8.4-mbstring-debuginfoUpgrade php-snmp-debuginfoUpgrade php8.4-process-debuginfoUpgrade php-dbg-debuginfoUpgrade php-intl-debuginfoUpgrade php-xml-debuginfoUpgrade php-xmlrpcUpgrade php8.4-odbc-debuginfoUpgrade php-embedded-debuginfoUpgrade php-common-debuginfoUpgrade php8.4-opcache-debuginfoUpgrade php-commonUpgrade libzipUpgrade phpUpgrade php-pecl-xdebug3-debuginfoUpgrade php-odbc-debuginfoUpgrade php8.4-pgsql-debuginfoUpgrade php8.4-cliUpgrade php8.4-debugsourceUpgrade php8.4-cli-debuginfoUpgrade php-embeddedUpgrade php8.4-soapUpgrade php8.4-ldapUpgrade php8.4-dbg-debuginfoUpgrade php-pecl-apcu-develUpgrade php-jsonUpgrade php-pecl-apcuUpgrade php8.4-odbcUpgrade php-pdoUpgrade php8.4-intlUpgrade php8.4-gd-debuginfoUpgrade php-pecl-apcu-debugsourceUpgrade php-dbgUpgrade php8.4-xmlUpgrade php-dba-debuginfoUpgrade libzip-tools-debuginfoUpgrade php-enchantUpgrade php-pecl-xdebug3Upgrade php-bcmathUpgrade libzip-debuginfoUpgrade php-fpm-debuginfoUpgrade php8.4-gdUpgrade php8.4-mysqlnd-debuginfoUpgrade php8.4-fpmUpgrade php-pecl-xdebugUpgrade php-pecl-rrd-debugsourceUpgrade php-gmp-debuginfoUpgrade php-enchant-debuginfoUpgrade php8.4-intl-debuginfoUpgrade php-ldapUpgrade php8.4-bcmath-debuginfoUpgrade php-develUpgrade php-odbcUpgrade php-pecl-xdebug3-debugsourceUpgrade php-pecl-xdebug-debuginfoUpgrade php-mysqlndUpgrade php-mbstring-debuginfoUpgrade php-json-debuginfoUpgrade php-fpmUpgrade php-ffi-debuginfoUpgrade php-debugsourceUpgrade php8.4-ffiUpgrade php-xmlUpgrade php-gmpUpgrade php-cliUpgrade php8.4-embeddedUpgrade php8.4-common-debuginfoUpgrade php-xmlrpc-debuginfoUpgrade php-pgsqlUpgrade php-pecl-xdebug-debugsourceUpgrade php-intlUpgrade php-opcacheUpgrade php8.4-mbstringUpgrade php-pecl-zipUpgrade php-pecl-zip-debugsourceUpgrade php-pecl-zip-debuginfoUpgrade php8.4-debuginfoUpgrade php-gd-debuginfo | Jun 2, 2026 | Jun 1, 2026 |
| Ubuntu | — | Upgrade php8.1Upgrade php8.5Upgrade php8.4Upgrade php8.3 | May 28, 2026 | May 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub