phpunit project phpunit vulnerabilities

Latest phpunit project phpunit CVEs

Newest publication first

1. CVE-2017-9841 Code Injection in PHPUnit

   Published 2017-06-27

   Critical·CVSS 9.8 EPSS 100.0% CISA KEV added 2022-02-15 Exploited in the wild Public exploit PoC

   Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...

2. CVE-2013-4744 PHPUnit extension for TYPO3 vulnerable to Cross-site Scripting

   Published 2013-07-01

   Medium·CVSS 4.3 EPSS 1.4%

   Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.