Skip to content
Noroxi

Thinkphp records

27 published records for vendor thinkphp.

Researcher profile

Entered KEV
1 · 3.7%
Weaponized
1 · 3.7%
Pre-auth RCE
11
With a fix record
18.5%
Median publish → KEV
983 days

Records by year

  1. 18
  2. 19
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

27 records
  • CVE-2019-9082
    94Now

    ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app

    HighCVSS 8.8KEVWeaponizedEPSS 97%

    thinkphp · thinkphpFeb 24, 2019

  • CVE-2022-47945
    47Plan

    ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_o

    CriticalCVSS 9.8Proof of conceptEPSS 28%

    thinkphp · thinkphpDec 23, 2022

  • CVE-2022-33107
    46Plan

    ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Stor

    CriticalCVSS 9.8No exploitEPSS 24%

    thinkphp · thinkphpJun 29, 2022

  • CVE-2022-38352
    45Plan

    ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache.

    CriticalCVSS 9.8No exploitEPSS 21%

    thinkphp · thinkphpSep 14, 2022

  • CVE-2024-44902
    40Plan

    A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    thinkphp · thinkphpSep 9, 2024

  • CVE-2021-36567
    40Plan

    ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.

    CriticalCVSS 9.8No exploitEPSS 2%

    thinkphp · thinkphpDec 6, 2021

  • CVE-2018-16385
    40Plan

    ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    thinkphp · thinkphpSep 2, 2018

  • CVE-2021-36564
    40Plan

    ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Stora

    CriticalCVSS 9.8No exploitEPSS 2%

    thinkphp · thinkphpDec 6, 2021

  • CVE-2020-20120
    40Plan

    ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query"

    CriticalCVSS 9.8No exploitEPSS 2%

    thinkphp · thinkphpSep 28, 2021

  • CVE-2021-23592
    40Plan

    Deserialization of Untrusted Data

    CriticalCVSS 9.8No exploitEPSS 2%

    thinkphp · thinkphpMay 6, 2022

  • CVE-2018-18546
    39Monitor

    ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the ke

    CriticalCVSS 9.8No exploitEPSS 2%

    thinkphp · thinkphpOct 20, 2018

  • CVE-2018-17566
    39Monitor

    In ThinkPHP 5.1.24, the inner function delete can be used for SQL injection when its WHERE condition's value can be controlled by a user's r

    CriticalCVSS 9.8No exploitEPSS 2%

    thinkphp · thinkphpSep 26, 2018

  • CVE-2021-44350
    39Monitor

    SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.

    CriticalCVSS 9.8No exploitEPSS 1%

    thinkphp · thinkphpDec 15, 2021

  • CVE-2022-45982
    39Monitor

    thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability.

    CriticalCVSS 9.8No exploitEPSS 1%

    thinkphp · thinkphpFeb 8, 2023

  • CVE-2018-18530
    39Monitor

    ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate

    CriticalCVSS 9.8No exploitEPSS 1%

    thinkphp · thinkphpOct 19, 2018

  • CVE-2018-18529
    39Monitor

    ThinkPHP 3.2.4 has SQL Injection via the count parameter because the Library/Think/Db/Driver/Mysql.class.php parseKey function mishandles th

    CriticalCVSS 9.8No exploitEPSS 1%

    thinkphp · thinkphpOct 19, 2018

  • CVE-2018-10225
    39Monitor

    thinkphp 3.1.3 has SQL Injection via the index.php s parameter.

    CriticalCVSS 9.8No exploitEPSS 1%

    thinkphp · thinkphpApr 19, 2018

  • CVE-2025-50706
    39Monitor

    An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function

    CriticalCVSS 9.8No exploitEPSS 1%

    thinkphp · thinkphpAug 5, 2025

  • CVE-2025-50707
    39Monitor

    An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component

    CriticalCVSS 9.8No exploitEPSS 1%

    thinkphp · thinkphpAug 5, 2025

  • CVE-2024-48112
    39Monitor

    A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary co

    CriticalCVSS 9.8No exploitEPSS 1%

    thinkphp · thinkphpOct 30, 2024

  • CVE-2025-63888
    39Monitor

    The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    thinkphp · thinkphpNov 20, 2025

  • CVE-2018-25270
    37Monitor

    ThinkPHP 5.0.23 Remote Code Execution via invokefunction

    CriticalCVSS 9.3No exploitEPSS 1%

    thinkphp · thinkphpApr 22, 2026

  • CVE-2022-44289
    36Monitor

    Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.

    HighCVSS 8.8No exploitEPSS 3%

    thinkphp · thinkphpDec 6, 2022

  • CVE-2021-44892
    36Monitor

    A Remote Code Execution (RCE) vulnerability exists in ThinkPHP 3.x.x via value[_filename] in index.php, which could let a malicious user obt

    HighCVSS 8.8No exploitEPSS 2%

    thinkphp · thinkphpFeb 10, 2022

  • CVE-2022-25481
    31Monitor

    ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter.

    HighCVSS 7.5Proof of conceptEPSS 5%

    thinkphp · thinkphpMar 20, 2022