UpHeron
All vulnerabilities

Servers and applications

CVE-2021-21705

In PHP versions 7.3.x below 7.3.29, 7.4.x below 7.4.21 and 8.0.x below 8.0.8, when using URL validation functionality via filter_var() function with FILTER_VALIDATE_URL parameter, an URL with invalid password field can be accepted as valid. This can lead to the code incorrectly parsing the URL and potentially leading to other security implications - like contacting a wrong server or making a…

Severity
Medium 5.3
Published
4 Oct 2021
Last changed
17 Jun 2026
Added to UpHeron
14 Oct 2026
Fixed in
7.3.29, 7.4.21, 8.0.8
Sources
NVD

Affected software

SoftwareAffected versions
PHPServers and applications · cpe:a:php:php
  • From 7.3.0 before 7.3.29
  • From 7.4.0 before 7.4.21
  • From 8.0.0 before 8.0.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-21705
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-21705