CVE-2015-4148

CVE-2015-4148 is a type confusion vulnerability in the do_soap_call function of PHP versions prior to 5.4.39, 5.5.23, and 5.6.7, affecting products like Apple, PHP, and Red Hat. This flaw allows remote attackers to obtain sensitive information by providing crafted serialized data with an integer data type instead of a string for the URI property. With a CVSS score of 5.0, it is a low-severity vulnerability with a network attack vector, low complexity, and a potential impact of partial confidentiality loss. While not actively exploited in the wild and not on the CISA KEV list, an exploit for memory exfiltration in SMF 2.0.10 exists on ExploitDB, though there is minimal community discussion or media coverage.