Skip to main content

PHP CVE-2026-6735

| EUVDEUVD-2026-28967 HIGH
Cross-site Scripting (XSS) (CWE-79)
2026-05-07
XSS Microsoft PHP Suse Red Hat
7.3
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
7.3 HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:Amber
SUSE
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Red Hat
5.4 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:X/RE:L/U:Amber
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
P
Scope
P

Lifecycle Timeline

5
Source Code Evidence Fetched
May 10, 2026 - 05:24 vuln.today
Analysis Generated
May 10, 2026 - 05:24 vuln.today
CVSS changed
May 10, 2026 - 05:22 NVD
7.3 (HIGH)
CVE Published
May 07, 2026 - 17:18 nvd
UNKNOWN (no severity yet)
CVE Published
May 07, 2026 - 17:18 nvd
HIGH 7.3

Description PRE-NVD

Disclosed via GitHub release of php/php-src. NVD scoring and full description are pending.

AnalysisAI

Cross-site scripting (XSS) vulnerability in PHP 8.2.x (prior to 8.2.31) allows network-based attackers to inject malicious scripts that execute in victim browsers, compromising session tokens and potentially escalating to account takeover. Vendor-released patch (PHP 8.2.31) addresses this along with seven additional CVEs in a coordinated security release. CVSS 7.3 HIGH with user interaction required; exploitation status classified as POC-available per CVSS 4.0 vector (E:P), though public exploit code not independently verified at time of analysis.

Technical ContextAI

This is a CWE-79 cross-site scripting vulnerability affecting the PHP 8.2 branch, likely in core PHP functionality given its inclusion in a coordinated security release addressing eight distinct CVEs. XSS vulnerabilities in server-side interpreters like PHP typically arise from inadequate input sanitization or output encoding in built-in functions, allowing attackers to inject client-side scripts through server-rendered content. The CVSS 4.0 vector indicates network attack vector (AV:N) with low attack complexity (AC:L) but requires some attack prerequisites (AT:P) and user interaction (UI:P), suggesting the vulnerability manifests when user-supplied data passes through a specific PHP feature or function without proper escaping. The high confidentiality and integrity impacts on both vulnerable and subsequent systems (VC:H/VI:H/SC:H/SI:H with scope change S:P) indicate potential for session hijacking and cross-domain attacks beyond the immediate vulnerable application.

RemediationAI

Upgrade to PHP 8.2.31 immediately, available from https://www.php.net/downloads.php with Windows binaries at https://www.php.net/downloads.php?os=windows&version=8.2. Full changelog at https://www.php.net/ChangeLog-8.php#8.2.31. The patched release addresses eight security vulnerabilities simultaneously, making this a high-priority update. Standard upgrade procedure: download appropriate package for your platform, verify GPG signatures, test in staging environment, then deploy to production. For organizations unable to upgrade immediately, implement input validation and output encoding at application layer: enforce strict Content Security Policy headers with 'nonce' or 'hash' directives to prevent inline script execution, apply context-aware output escaping (htmlspecialchars with ENT_QUOTES|ENT_HTML5 flags for HTML contexts), and validate/sanitize all user inputs before processing. Note that application-layer mitigations are incomplete substitutes for patching and introduce maintenance overhead; they only reduce attack surface for unknown XSS vectors while the vulnerability remains exploitable through PHP core functionality. Web Application Firewall (WAF) rules detecting common XSS patterns provide defense-in-depth but may be bypassed through encoding variations or context-specific attacks. Prioritize upgrading over workarounds.

More in PHP

View all
CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2016-1555 CRITICAL POC
9.8 Apr 21

(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
CVE-2024-11680 CRITICAL POC
9.8 Nov 26

ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2017-9841 CRITICAL POC
9.8 Jun 27

Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
CVE-2025-0108 HIGH POC
8.8 Feb 12

Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers

CVE-2021-25298 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-25296 HIGH POC
8.8 Feb 15

Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2013-4983 CRITICAL POC
10.0 Sep 10

The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
CVE-2023-6553 CRITICAL POC
9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
CVE-2024-46506 CRITICAL POC
10.0 May 13

NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
CVE-2024-8353 CRITICAL POC
9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-6735 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy