CVE-2015-5243

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-52449.8The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.CVE-2015-52454.3CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitraCVE-2015-52468.1The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors invCVE-2015-52476.5The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a deCVE-2015-52486.5Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform.CVE-2015-52504.0The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data.CVE-2015-52515.5OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the sCVE-2015-52527.2vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relatiCVE-2015-52534.0The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass CVE-2015-52549.8Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execuCVE-2015-52554.3Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.xCVE-2015-52564.3Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection
CVE-2015-5243: Critical severity, CVSS 9.8 | Vulnix