UpHeron
All vulnerabilities

Servers and applications

CVE-2015-6527

The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.

Severity
High 7.3
Published
19 Jan 2016
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • Version 7.0.0
  • Version 7.0.0-rc8
  • Version 7.0.0-rc7
  • Version 7.0.0-rc6
All 14 release lines
  • Version 7.0.0-alpha1
  • Version 7.0.0-alpha2
  • Version 7.0.0-beta1
  • Version 7.0.0-beta2
  • Version 7.0.0-beta3
  • Version 7.0.0-rc1
  • Version 7.0.0-rc2
  • Version 7.0.0-rc3
  • Version 7.0.0-rc4
  • Version 7.0.0-rc5
  • Version 7.0.0-rc6
  • Version 7.0.0-rc7
  • Version 7.0.0-rc8
  • Version 7.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2015-6527
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2015-6527