phpunit project records
4 published records for vendor phpunit project. 1 of them have been exploited in the wild (listed in CISA KEV) and 1 have a ready-made attack tool.
Researcher profile
- Entered KEV
- 1 · 25%
- Weaponized
- 1 · 25%
- Pre-auth RCE
- 1
- With a fix record
- 100%
- Median publish → KEV
- 1694 days
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-502 Deserialization of Untrusted Data1
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')1
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
4 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
99Now | CVE-2017-9841Weaponized | Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST daphpunit project · phpunit · CWE-94 | Critical9.8KEV | 99.9%Jun 27, 2017 |
31Monitor | CVE-2026-24765No exploit | PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handlingphpunit project · phpunit · CWE-502 | High7.8 | 0.3%Jan 27, 2026 |
31Monitor | CVE-2026-41570No exploit | PHPUnit: Argument injection via newline in PHP INI values forwarded to child processesphpunit project · phpunit · CWE-88 | High7.8 | 0.1%May 8, 2026 |
17Monitor | CVE-2013-4744No exploit | Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web scphpunit project · phpunit · CWE-79 | Medium4.3 | 1.3%Jul 1, 2013 |
- CVE-2017-984199Now
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST da
CriticalCVSS 9.8KEVWeaponizedEPSS 99%phpunit project · phpunitJun 27, 2017
- CVE-2026-2476531Monitor
PHPUnit Vulnerable to Unsafe Deserialization in PHPT Code Coverage Handling
HighCVSS 7.8No exploitEPSS 0%phpunit project · phpunitJan 27, 2026
- CVE-2026-4157031Monitor
PHPUnit: Argument injection via newline in PHP INI values forwarded to child processes
HighCVSS 7.8No exploitEPSS 0%phpunit project · phpunitMay 8, 2026
- CVE-2013-474417Monitor
Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web sc
MediumCVSS 4.3No exploitEPSS 1%phpunit project · phpunitJul 1, 2013