Phpwebthings develops a web application framework where the vulnerability pattern centers on input-handling and access-control weaknesses characteristic of server-side application code, specifically path traversal and SQL injection flaws alongside generic categorization. Despite the modest vulnerability volume, the vendor's disclosures frequently acquire public exploit code, reflecting the appeal of these weakness classes to security researchers and attackers working with web applications. Live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phpwebthings over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2005-4226HIGH Multiple "potential" SQL injection vulnerabilities in phpWebThings 1.4 Patched might allow remote attackers to execute arbitrary SQL commands via (1) the ref parameter in download. | Dec 14, 2005 | 7.5 | 29 | NO | YES |
CVE-2009-2147HIGH SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter. | Jun 22, 2009 | 7.5 | 28 | NO | YES |
CVE-2006-6042MEDIUM PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP cod | Nov 22, 2006 | 6.8 | 28 | NO | YES |
CVE-2005-4218HIGH SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands via the msg parameter, a different vulnerability than CVE-200 | Dec 14, 2005 | 7.5 | 28 | NO | YES |
CVE-2005-3676HIGH SQL injection vulnerability in download.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the file parameter. | Nov 18, 2005 | 7.5 | 28 | NO | YES |
CVE-2007-3141MEDIUM PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 allows remote attackers to execute arbitrary PHP code via a URL in the editor_insert_top parameter. | Jun 11, 2007 | 6.8 | 27 | NO | YES |
CVE-2009-2081MEDIUM Directory traversal vulnerability in help.php in phpWebThings 1.5.2 and earlier, when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot do | Jun 16, 2009 | 4.3 | 21 | NO | YES |
CVE-2005-3584MEDIUM Cross-site scripting (XSS) vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to inject arbitrary web script or HTML via the forum parameter. | Nov 16, 2005 | 4.3 | 21 | NO | YES |
CVE-2005-3585HIGH SQL injection vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL commands via the forum parameter. | Nov 16, 2005 | 7.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phpwebthings.
Media articles that mention a CVE ID that affects a product developed by Phpwebthings — matched by CVE ID, not by vendor name.