Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
37 results
Apr 22, 2026ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions throughCVE-2018-25270 · Other software · Thinkphp · reported by VulnCheckCritical 9.3
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.
- Product
- ThinkPHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 20, 2025The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template vCVE-2025-63889 · Other software · Thinkphp · reported by MITREHigh 7.5
The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comyuque.com
Nov 20, 2025The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.CVE-2025-63888 · Other software · Thinkphp · reported by MITRECritical 9.8
The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comyuque.com
Aug 5, 2025An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php componentCVE-2025-50707 · Other software · Thinkphp · reported by MITRECritical 9.8
An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxinyisleep.github.ioxinyisleep.github.io
Aug 5, 2025An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck functionCVE-2025-50706 · Other software · Thinkphp · reported by MITRECritical 9.8
An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxinyisleep.github.ioxinyisleep.github.io
Oct 30, 2024A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.CVE-2024-48112 · Other software · thinkphp · reported by MITRECritical 9.8
A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
- Product
- thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2024A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.CVE-2024-44902 · Other software · thinkphp · reported by MITRECritical 9.8
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
- Product
- thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.phpCVE-2024-41351 · Other software · baijunyao · reported by MITREMedium 6.1
bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/getContent.php
- Product
- thinkphp-bjyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.phpCVE-2024-41350 · Other software · baijunyao · reported by MITREMedium 6.1
bjyadmin commit a560fd5 is vulnerable to Cross Site Scripting (XSS) via Public/statics/umeditor1_2_3/php/imageUp.php
- Product
- thinkphp-bjyadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2024ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.CVE-2024-34467 · Other software · thinkphp · reported by MITREMedium 6.1
ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.
- Product
- thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability.CVE-2022-45982 · Other software · Thinkphp · reported by MITRECritical 9.8
thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 23, 2022ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true).CVE-2022-47945 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2022Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.CVE-2022-44289 · Other software · Thinkphp · reported by MITREHigh 8.8
Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache.CVE-2022-38352 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 29, 2022ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.phCVE-2022-33107 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2022The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.CVE-2021-23592 · Other software · Thinkphp · reported by report@snyk.ioHigh 7.7
The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password.CVE-2022-27442 · Other software · Tpcms Project · reported by MITREHigh 7.5
TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password.
- Product
- Tpcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2022ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter.CVE-2022-25481 · Other software · thinkphp · reported by MITREHigh 7.5
ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php. NOTE: this is disputed by a third party because system environment exposure is an intended feature of the debugging mode.
- Product
- thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2022A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control pCVE-2021-44892 · Other software · Thinkphp · reported by MITREHigh 8.8
A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obtain server control privileges.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.CVE-2021-44350 · Other software · Thinkphp · reported by MITRECritical 9.8
SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2021ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.CVE-2021-36567 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 6, 2021ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.CVE-2021-36564 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2021thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php.CVE-2021-43682 · Other software · Thinkphp-bjyblog Project · reported by MITREMedium 6.1
thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The exit function terminates the script and prints a message to the user that contains $_SERVER['HTTP_HOST'].
- Product
- Thinkphp-bjyblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 29, 2021Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability.CVE-2021-43697 · Other software · Workerman-thinkphp-redis Project · reported by MITREMedium 6.1
Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET{C('VAR_JSONP_HANDLER')] then there is a XSS vulnerability.
- Product
- Workerman-thinkphp-redis
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2021ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha.CVE-2020-21865 · Other software · Thinkphp50-cms Project · reported by MITRECritical 9.8
ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha.
- Product
- Thinkphp50-cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2021ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.CVE-2020-20120 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2021thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.CVE-2020-19705 · Other software · Thinkphp-zcms Project · reported by MITRECritical 9.8
thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.
- Product
- Thinkphp-zcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2021In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functionCVE-2020-35339 · Other software · 74cms · reported by MITRECritical 9.8
In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server.
- Product
- 74cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2019ThinkPHP Remote Code Execution VulnerabilityCVE-2019-9082 · Other software · ThinkPHP · reported by MITREExploitedHigh 8.8
ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.
- Product
- ThinkPHP
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install ThinkPHP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comgithub.com
Dec 11, 2018ThinkPHP "noneCms" Remote Code Execution VulnerabilityCVE-2018-20062 · Other software · ThinkPHP · reported by MITREExploitedCritical 9.8
ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.
- Product
- noneCms
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install ThinkPHP’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.comgithub.com
Oct 20, 2018ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.CVE-2018-18546 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the key variable.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record98587329.github.iogithub.com
Oct 19, 2018ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable.CVE-2018-18530 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2018ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable.CVE-2018-18529 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles the key variable. NOTE: a backquote character is not required in the attack URI.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2018In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.CVE-2018-17566 · Other software · Thinkphp · reported by MITRECritical 9.8
In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's request.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2018Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.CVE-2018-16655 · Other software · Gxlcms · reported by MITREMedium 6.1
Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.
- Product
- Gxlcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlengjibo.github.io
Sep 2, 2018ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.CVE-2018-16385 · Other software · Thinkphp · reported by MITRECritical 9.8
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexchange.xforce.ibmcloud.com
Apr 19, 2018thinkphp 3.1.3 has SQL Injection via the index.php s parameter.CVE-2018-10225 · Other software · Thinkphp · reported by MITRECritical 9.8
thinkphp 3.1.3 has SQL Injection via the index.php s parameter.
- Product
- Thinkphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.