phpwhois project phpwhois vulnerabilities

Latest phpwhois project phpwhois CVEs

Newest publication first

1. CVE-2021-43698 phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. In file example.php, the exit function will terminate the script and print the message to the user. The me...

   Published 2021-11-29

   Medium·CVSS 6.1 EPSS 0.63%

   phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. In file example.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET['query'] then there is a XSS vulnerability.

2. CVE-2015-5243 phpWhois arbitrary code execution via a crafted whois record

   Published 2018-08-20

   Critical·CVSS 9.8 EPSS 6.2% PoC

   phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

3. CVE-2015-3998 Adsense Click Fraud Monitoring <= 1.8.6 - Reflected Cross-Site Scripting

   Published 2017-05-17

   Medium·CVSS 6.1 EPSS 1.1%

   Cross-site scripting (XSS) vulnerability in phpwhois 4.2.5, as used in the adsense-click-fraud-monitoring plugin 1.7.5 for WordPress, allows remote attackers to inject arbitrary web script or HTML via the query parameter to whois.php.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.