CVE-2024-1874

CriticalCVSS 9.4/10Last modified Jun 17, 2026

Description

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Apr 29, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-18758.8A vulnerability was found in SourceCodester Complaint Management System 1.0 and classified as critical. This issue affects some unknown proc CVE-2024-18769.8A vulnerability was found in SourceCodester Employee Management System 1.0. It has been classified as critical. Affected is an unknown funct CVE-2024-18778.8A vulnerability was found in SourceCodester Employee Management System 1.0. It has been declared as critical. Affected by this vulnerability CVE-2024-18788.8A vulnerability was found in SourceCodester Employee Management System 1.0. It has been rated as critical. Affected by this issue is some un CVE-2024-18798.8A Cross-Site Request Forgery (CSRF) vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary comma CVE-2024-18807.8An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecti CVE-2024-18819.8AutoGPT, a component of significant-gravitas/autogpt, is vulnerable to an improper neutralization of special elements used in an OS command CVE-2024-18827.2This vulnerability allows an already authenticated admin user to create a malicious payload that could be leveraged for remote code executio CVE-2024-18836.1This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by cr CVE-2024-18846.5This is a Server-Side Request Forgery (SSRF) vulnerability in the PaperCut NG/MF server-side module that allows an attacker to induce the s CVE-2024-18859.8This vulnerability allows remote attackers to execute arbitrary code on the affected webOS of LG Signage.CVE-2024-18868.8This vulnerability allows remote attackers to traverse the directory on the affected webOS of LG Signage.