References https://avd.aliyun.com/detail?id=AVD-2018-18529 https://security.zone.ci/aliyun/ali_highrisk/12131.html https://security.zone.ci/aliyun/ali_highrisk/12130.html http://www.gxaqhbzx.com/news/shownews.php?id=29 https://avd.aliyun.com/product?prod=thinkphp https://cve.akaoma.com/vendor/thinkphp
Related VulnerabilitiesPoCCVE-2019-11043: PHP-FPM Path Info Buffer Underflow - Remote Code ExecutionPoCCVE-2026-49049: JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File WritePoCCVE-2026-48611: phpBB < 3.3.17 - Authentication BypassPoCCVE-2026-46364: phpMyFAQ <= 4.1.1 - SQL InjectionPoCCVE-2026-6433: FlipperCode Custom CSS, JS & PHP <= 2.0.7 - Remote Code ExecutionphpVMS /importer 未授权访问漏洞（CVE-2026-42569）PoCphpjabbers-event-booking-xss: PHPJabbers Event Booking Calendar - Reflected XSSphpMyFAQ /api/captcha SQL 注入漏洞PoCCVE-2025-34030: sar2html <=3.2.2 Plot Parameter - Remote Code ExecutionPoCCVE-2026-42569: phpVMS < 7.0.6 - Legacy Importer Authorization BypassphpVMS存在权限绕过漏洞(CVE-2026-42569)PoCCVE-2020-26935: phpMyAdmin < 5.0.3 - SQL InjectionPoCphp-prober-exposure: PHP Prober - Exposure