Description

This alert was generated using only banner information. It may be a false positive.


PHP 3 and 4 do not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands by triggering error messages that are improperly written to the error logs.

Remediation

Upgrade to the latest version of PHP.

References

Format string attack | OWASP Foundation

Related Vulnerabilities

WordPress Plugin wpCommentTwit Cross-Site Request Forgery (0.5)

MySQL CVE-2021-2122 Vulnerability (CVE-2021-2122)

OpenSSL Excessive Iteration Vulnerability (CVE-2023-3817)

WordPress Plugin Greg's High Performance SEO Cross-Site Scripting (1.6.1)

WordPress Plugin Contact Form 7 Database Multiple Vulnerabilities (1.1)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update CWE-20 CVE-2000-0967