https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 08:24:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-318851 EUVD-2026-318851 https://cve.radiocsirt.org/vuln/euvd-2026-318851 https://cve.radiocsirt.org/vuln/fkie_cve-2015-10141 <p>An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.</p> <p>An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2015-10141 https://cve.radiocsirt.org/vuln/ghsa-267w-63f8-m896 <p>An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.</p> <p>An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.</p> https://cve.radiocsirt.org/vuln/ghsa-267w-63f8-m896 https://cve.radiocsirt.org/vuln/ubuntu-cve-2015-10141 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: xdebug, Ubuntu:18.04:LTS: xdebug, Ubuntu:20.04:LTS: xdebug, Ubuntu:22.04:LTS: xdebug, Ubuntu:24.04:LTS: xdebug, Ubuntu:25.10: xdebug, Ubuntu:26.10: xdebug, Ubuntu:26.04:LTS: xdebug</p> <p>An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: xdebug, Ubuntu:18.04:LTS: xdebug, Ubuntu:20.04:LTS: xdebug, Ubuntu:22.04:LTS: xdebug, Ubuntu:24.04:LTS: xdebug, Ubuntu:25.10: xdebug, Ubuntu:26.10: xdebug, Ubuntu:26.04:LTS: xdebug</p> <p>An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker can send a crafted eval command over this interface to execute arbitrary PHP code, which may invoke system-level functions such as system() or passthru(). This results in full compromise of the host under the privileges of the web server user.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2015-10141