Thinkphp
Vulnerability activity for Thinkphp: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 8.8HighFeb 24, 2019ThinkPHP Auth bypass / access controlCVE-2019-9082ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.Added to KEV Nov 3, 2021 · 982 days after publicationExploited97% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalDec 11, 2018ThinkPHP noneCms Code / command injectionCVE-2018-20062ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.Added to KEV Nov 3, 2021 · 1,057 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
Recent
- 9.8CriticalApr 22, 2026thinkphp Auth bypass / access controlCVE-2018-25270ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.
- 7.5HighNov 20, 2025thinkphp Memory corruptionCVE-2025-63889The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.
- 9.8CriticalNov 20, 2025thinkphp Path traversal / file handlingCVE-2025-63888The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
- 8.8HighFeb 24, 2019ThinkPHP Auth bypass / access controlCVE-2019-9082ThinkPHP contains an unspecified vulnerability that allows for remote code execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.Exploited97% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 9.8CriticalDec 11, 2018ThinkPHP noneCms Code / command injectionCVE-2018-20062ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
Top products
- thinkphp3 CVEs in the last year, 2 critical
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.