CWE-616: PHP
The PHP application uses an old method for processing uploaded files by referencing the four global variables that are set for each file (e.g. $varname, $varname_size, $varname_name, $varname_type). These variables could be overwritten by attackers, causing the application to process unauthorized files.
3 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2026-67198 — Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher
- CVE-2024-52305 — UnoPim Stored XSS : Cookie hijacking through Create User function
- CVE-2026-22789 — WebErpMesv2 has a File Upload Validation Bypass Leading to RCE
Recently published
- CVE-2026-67198 — Perspective 5.0.0 DoS via VirtualServer Protocol Dispatcher
- CVE-2026-22789 — WebErpMesv2 has a File Upload Validation Bypass Leading to RCE
- CVE-2024-52305 — UnoPim Stored XSS : Cookie hijacking through Create User function