apache friends xampp vulnerabilities

Latest apache friends xampp CVEs

Newest publication first

1. CVE-2012-10062 XAMPP WebDAV PHP Upload Authentication Bypass RCE

   Published 2025-08-30

   High·CVSS 8.7 EPSS 1.9% Framework module

   A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authenticated attackers to upload and execute arbitrary PHP code. The WebDAV service, accessible via /webdav/, accepts HTTP PUT requests using default credentials. Th...

2. CVE-2024-5055 Vulnerability of uncontrolled resource consumption in XAMPP

   Published 2024-05-17

   High·CVSS 7.5 EPSS 0.44%

   Uncontrolled resource consumption vulnerability in XAMPP Windows, versions 7.3.2 and earlier. This vulnerability exists when XAMPP attempts to process many incomplete HTTP requests, resulting in resource consumption and system crashes.

3. CVE-2008-4450 Cross-site scripting (XSS) vulnerability in adodb.php in XAMPP for Windows 1.6.8 allows remote attackers to inject arbitrary web script or HTML via the (1) dbserver, (2) host, (3) user, (4) password,....

   Published 2008-10-06

   Medium·CVSS 4.3 EPSS 1.0%

   Cross-site scripting (XSS) vulnerability in adodb.php in XAMPP for Windows 1.6.8 allows remote attackers to inject arbitrary web script or HTML via the (1) dbserver, (2) host, (3) user, (4) password, (5) database, and (6) table parameters. NOTE: the provenance of this information...

4. CVE-2008-3569 Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.6.7, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the text parameter to (1) iart.p...

   Published 2008-08-10

   Medium·CVSS 4.3 EPSS 3.0%

   Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.6.7, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the text parameter to (1) iart.php and (2) ming.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.