UpHeron
All vulnerabilities

Servers and applications

CVE-2018-10547

An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.

Severity
Medium 6.1
Published
29 Apr 2018
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Fixed in
5.6.36, 7.0.30, 7.1.17, 7.2.5
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • Every version before 5.6.36
  • From 7.0.0 before 7.0.30
  • From 7.1.0 before 7.1.17
  • From 7.2.0 before 7.2.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-10547
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-10547