Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, 8.5.* before 8.5.6, due to improper sanitation of user data, it allows an attacker to compose an URL, which will cause the target to execute arbitrary JavaScript code (XSS) on the target's machine when the target is viewing the PHP-FPM status page.
Remediation
References
Related Vulnerabilities
Oracle Database Server CVE-2020-2512 Vulnerability (CVE-2020-2512)
MySQL CVE-2016-0596 Vulnerability (CVE-2016-0596)
MySQL CVE-2019-2627 Vulnerability (CVE-2019-2627)
Oracle HTTP Server Missing Authentication for Critical Function Vulnerability (CVE-2026-60365)
OpenSSL Improper Check for Unusual or Exceptional Conditions Vulnerability (CVE-2023-5678)