CVE-2015-10141

CVE-2015-10141 describes an unauthenticated OS command injection vulnerability in Xdebug versions 2.5.5 and earlier, a PHP debugging extension. When remote debugging is enabled, an attacker can send crafted debugger protocol commands to execute arbitrary PHP code, leading to full host compromise under web server user privileges. This critical vulnerability has a CVSS score of 9.3, indicating a network-based attack with low complexity and high impact on confidentiality, integrity, and availability. While not on the KEV catalog, exploit modules exist in Metasploit and Nuclei, and it has significant community discussion, suggesting active interest and potential for exploitation.