In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??= operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.

vendor_unpatched cve-2024-11235: Unpatched CVEs for Debian Linux (cve-2024-11235)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-922 advisory.

    NOTE:https://github.com/php/php-src/security/advisories/GHSA-     rwp7-7vc6-8477https://www.tenable.com/cve/CVE-2024-11235

    VersionThis vulnerability is present only in PHP 8.3+. The PHP 8.2 and versions before are not impacted.()     (CVE-2024-11235)

    Header parser of `http` stream wrapper does not handle folded headers. (CVE-2025-1217)

    When requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is     used to determine the charset when the requested resource performs a redirect. (CVE-2025-1219)

    Streams HTTP wrapper does not fail for headers with invalid name and no colon. (CVE-2025-1734)

    Stream HTTP wrapper header check might omit basic auth header. (CVE-2025-1736)

    Stream HTTP wrapper truncate redirect location to 1024 bytes (CVE-2025-1861)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7400-1 advisory.

    It was discovered that PHP incorrectly handle certain inputs. An attacker could possibly use this issue to     cause a crash or execute arbitrary code. (CVE-2024-11235)

    It was discovered that PHP incorrectly handle certain folded headers. An attacker could possibly use this     issue to cause a crash or execute arbritrary code. (CVE-2025-1217)

    It was discovered that PHP incorrectly handled certain headers. An attacker could possibly use this issue     to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS     Ubuntu 24.10, and Ubuntu 24.04 LTS. (CVE-2025-1219)

    It was discovered that PHP incorrectly handle certain headers with invalid name and no colon. An attacker     could possibly use this issue to confuse applications into accepting invalid headers causing code     injection. (CVE-2025-1734)

    It was discovered that PHP incorrectly handled certain headers. An attacker could possibly use this issue     to cause a denial of service. This issue only affected Ubuntu 22.04 LTS, Ubuntu 24.10, and Ubuntu 24.04     LTS. (CVE-2025-1736)

    It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue     to expose sensitive information. (CVE-2025-1861)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1025-1 advisory.

    - CVE-2024-11235: Fixed reference counting in php_request_shutdown causing Use-After-Free (bsc#1239666)
    - CVE-2025-1217: Fixed header parser of http stream wrapper not handling folded headers (bsc#1239664)
    - CVE-2025-1219: Fixed libxml streams using wrong content-type header when requesting a redirected     resource (bsc#1239667)
    - CVE-2025-1734: Fixed streams HTTP wrapper not failing for headers with invalid name and no colon     (bsc#1239668)
    - CVE-2025-1736: Fixed stream HTTP wrapper header check might omitting basic auth header (bsc#1239670)
    - CVE-2025-1861: Fixed stream HTTP wrapper truncate redirect location to 1024 bytes (bsc#1239669)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1026-1 advisory.

    - CVE-2024-11235: Fixed reference counting in php_request_shutdown causing Use-After-Free (bsc#1239666)
    - CVE-2025-1217: Fixed header parser of http stream wrapper not handling folded headers (bsc#1239664)
    - CVE-2025-1219: Fixed libxml streams using wrong content-type header when requesting a redirected     resource (bsc#1239667)
    - CVE-2025-1734: Fixed streams HTTP wrapper not failing for headers with invalid name and no colon     (bsc#1239668)
    - CVE-2025-1736: Fixed stream HTTP wrapper header check might omitting basic auth header (bsc#1239670)
    - CVE-2025-1861: Fixed stream HTTP wrapper truncate redirect location to 1024 bytes (bsc#1239669)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1012-1 advisory.

    - CVE-2025-1217: Fixed header parser of `http` stream wrapper not handling folded headers (bsc#1239664)
    - CVE-2024-11235: Fixed reference counting in php_request_shutdown causing Use-After-Free (bsc#1239666)
    - CVE-2025-1219: Fixed libxml streams using wrong `content-type` header when requesting a redirected     resource (bsc#1239667)
    - CVE-2025-1734: Fixed streams HTTP wrapper not failing for headers with invalid name and no colon     (bsc#1239668)
    - CVE-2025-1861: Fixed stream HTTP wrapper truncate redirect location to 1024 bytes (bsc#1239669)
    - CVE-2025-1736: Fixed stream HTTP wrapper header check might omitting basic auth header (bsc#1239670)

    Version update to 8.2.28:
        Core:
            Fixed bug GH-17211 (observer segfault on function loaded with dl()).
        LibXML:
            Fixed GHSA-wg4p-4hqh-c3g9.
            Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong `content-type` header when requesting a     redirected resource).
        Streams:
            Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header).
            Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes).
            Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon).
            Fixed GHSA-v8xr-gpvj-cx9g (Header parser of `http` stream wrapper does not handle folded headers).

    Version update version 8.2.27         Calendar:
            Fixed jdtogregorian overflow.
            Fixed cal_to_jd julian_days argument overflow.
        COM:
            Fixed bug GH-16991 (Getting typeinfo of non DISPATCH variant segfaults).
        Core:
            Fail early in *nix configuration build script.
            Fixed bug GH-16727 (Opcache bad signal 139 crash in ZTS bookworm (frankenphp)).
            Fixed bug GH-16799 (Assertion failure at Zend/zend_vm_execute.h:7469).
            Fixed bug GH-16630 (UAF in lexer with encoding translation and heredocs).
            Fix is_zend_ptr() huge block comparison.
            Fixed potential OOB read in zend_dirname() on Windows.
        Curl:
            Fix various memory leaks in curl mime handling.
        FPM:
            Fixed GH-16432 (PHP-FPM 8.2 SIGSEGV in fpm_get_status).
        GD:
            Fixed GH-16776 (imagecreatefromstring overflow).
        GMP:
            Revert gmp_pow() overly restrictive overflow checks.
        Hash:
            Fixed GH-16711: Segfault in mhash().
        Opcache:
            Fixed bug GH-16770 (Tracing JIT type mismatch when returning UNDEF).
            Fixed bug GH-16851 (JIT_G(enabled) not set correctly on other threads).
            Fixed bug GH-16902 (Set of opcache tests fail zts+aarch64).
        OpenSSL:
            Prevent unexpected array entry conversion when reading key.
            Fix various memory leaks related to openssl exports.
            Fix memory leak in php_openssl_pkey_from_zval().
        PDO:
            Fixed memory leak of `setFetchMode()`.
        Phar:
            Fixed bug GH-16695 (phar:// tar parser and zero-length file header blocks).
        PHPDBG:
            Fixed bug GH-15208 (Segfault with breakpoint map and phpdbg_clear()).
        SAPI:
            Fixed bug GH-16998 (UBSAN warning in rfc1867).
        SimpleXML:
            Fixed bug GH-16808 (Segmentation fault in RecursiveIteratorIterator ->current() with a xml element     input).
        SNMP:
            Fixed bug GH-16959 (snmget modifies the object_id array).
        Standard:
            Fixed bug GH-16905 (Internal iterator functions can't handle UNDEF properties).
        Streams:
            Fixed network connect poll interuption handling.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0994-1 advisory.

    - CVE-2024-11235: Fixed reference counting in php_request_shutdown causing Use-After-Free (bsc#1239666)
    - CVE-2025-1217: Fixed header parser of http stream wrapper not handling folded headers (bsc#1239664)
    - CVE-2025-1219: Fixed libxml streams using wrong content-type header when requesting a redirected     resource (bsc#1239667)
    - CVE-2025-1734: Fixed streams HTTP wrapper not failing for headers with invalid name and no colon     (bsc#1239668)
    - CVE-2025-1736: Fixed stream HTTP wrapper header check might omitting basic auth header (bsc#1239670)
    - CVE-2025-1861: Fixed stream HTTP wrapper truncate redirect location to 1024 bytes (bsc#1239669)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4e7e2c40e0 advisory.

    **PHP version 8.3.19** (13 Mar 2025)

    **BCMath:**

    * Fixed bug [GH-17398](https://github.com/php/php-src/issues/17398) (bcmul memory leak). (SakiTakamachi)

    **Core:**

    * Fixed bug [GH-17623](https://github.com/php/php-src/issues/17623) (Broken stack overflow detection for     variable compilation). (ilutov)
    * Fixed bug [GH-17618](https://github.com/php/php-src/issues/17618) (UnhandledMatchError does not take     zend.exception_ignore_args=1 into account). (timwolla)
    * Fix fallback paths in fast_long_{add,sub}_function. (nielsdos)
    * Fixed bug [GH-17718](https://github.com/php/php-src/issues/17718) (Calling static methods on an     interface that has `__callStatic` is allowed). (timwolla)
    * Fixed bug [GH-17797](https://github.com/php/php-src/issues/17797) (zend_test_compile_string crash on     invalid script path). (David Carlier)
    * Fixed [GHSA-rwp7-7vc6-8477](https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477)     (Reference counting in php_request_shutdown causes Use-After-Free). (**CVE-2024-11235**) (ilutov)

    **DOM:**

    * Fixed bug [GH-17847](https://github.com/php/php-src/issues/17847) (xinclude destroys live node).
    (nielsdos)

    **FFI:**

    * Fix FFI Parsing of Pointer Declaration Lists. (davnotdev)

    **FPM:**

    * Fixed bug [GH-17643](https://github.com/php/php-src/issues/17643) (FPM with httpd ProxyPass encoded     PATH_INFO env). (Jakub Zelenka)

    **GD:**

    * Fixed bug [GH-17772](https://github.com/php/php-src/issues/17772) (imagepalettetotruecolor crash with     memory_limit=2M). (David Carlier)

    **LDAP:**

    * Fixed bug [GH-17704](https://github.com/php/php-src/issues/17704) (ldap_search fails when $attributes     contains a non-packed array with numerical keys). (nielsdos, 7u83)

    **LibXML:**

    * Fixed [GHSA-wg4p-4hqh-c3g9](https://github.com/php/php-src/security/advisories/GHSA-wg4p-4hqh-c3g9)     (Reocurrence of php#72714). (nielsdos)
    * Fixed [GHSA-p3x9-6h7p-cgfc](https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc)     (libxml streams use wrong `content-type` header when requesting a redirected resource).
    (**CVE-2025-1219**) (timwolla)

    **MBString:**

    * Fixed bug [GH-17503](https://github.com/php/php-src/issues/17503) (Undefined float conversion in     mb_convert_variables). (cmb)

    **Opcache:**

    * Fixed bug [GH-17654](https://github.com/php/php-src/issues/17654) (Multiple classes using same trait     causes function JIT crash). (nielsdos)
    * Fixed bug [GH-17577](https://github.com/php/php-src/issues/17577) (JIT packed type guard crash).
    (nielsdos, Dmitry)
    * Fixed bug [GH-17899](https://github.com/php/php-src/issues/17899) (zend_test_compile_string with invalid     path when opcache is enabled). (David Carlier)
    * Fixed bug [GH-17868](https://github.com/php/php-src/issues/17868) (Cannot allocate memory with tracing     JIT). (nielsdos)

    **PDO_SQLite:**

    * Fixed [GH-17837](https://github.com/php/php-src/issues/17837) ()::getColumnMeta() on unexecuted     statement segfaults). (cmb)
    * Fix cycle leak in sqlite3 setAuthorizer(). (nielsdos)

    **Phar:**

    * Fixed bug [GH-17808](https://github.com/php/php-src/issues/17808): PharFileInfo refcount bug. (nielsdos)

    **PHPDBG:**

    * Partially fixed bug [GH-17387](https://github.com/php/php-src/issues/17387) (Trivial crash in phpdbg     lexer). (nielsdos)
    * Fix memory leak in phpdbg calling registered function. (nielsdos)

    **Reflection:**

    * Fixed bug [GH-15902](https://github.com/php/php-src/issues/15902) (Core dumped in     ext/reflection/php_reflection.c). (DanielEScherzer)

    **Standard:**

    * Fixed bug php#72666 (stat cache clearing inconsistent between file:// paths and plain paths). (Jakub     Zelenka)

    **Streams:**

    * Fixed bug [GH-17650](https://github.com/php/php-src/issues/17650) (realloc with size 0 in     user_filters.c). (nielsdos)
    * Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
    * Fixed [GHSA-hgf54-96fm-v528](https://github.com/php/php-src/security/advisories/GHSA-hgf54-96fm-v528)     (Stream HTTP wrapper header check might omit basic auth header). (**CVE-2025-1736**) (Jakub Zelenka)
    * Fixed [GHSA-52jp-hrpf-2jff](https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff)     (Stream HTTP wrapper truncate redirect location to 1024 bytes). (**CVE-2025-1861**) (Jakub Zelenka)
    * Fixed [GHSA-pcmh-g36c-qc44](https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44)     (Streams HTTP wrapper does not fail for headers without colon). (**CVE-2025-1734**) (Jakub Zelenka)
    * Fixed [GHSA-v8xr-gpvj-cx9g](https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g)     (Header parser of `http` stream wrapper does not handle folded headers). (**CVE-2025-1217**) (Jakub     Zelenka)

    **Zlib:**

    * Fixed bug [GH-17745](https://github.com/php/php-src/issues/17745) (zlib extension incorrectly handles     object arguments). (nielsdos)
    * Fix memory leak when encoding check fails. (nielsdos)
    * Fix zlib support for large files. (nielsdos)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-8d0acf5a57 advisory.

    **PHP version 8.3.19** (13 Mar 2025)

    **BCMath:**

    * Fixed bug [GH-17398](https://github.com/php/php-src/issues/17398) (bcmul memory leak). (SakiTakamachi)

    **Core:**

    * Fixed bug [GH-17623](https://github.com/php/php-src/issues/17623) (Broken stack overflow detection for     variable compilation). (ilutov)
    * Fixed bug [GH-17618](https://github.com/php/php-src/issues/17618) (UnhandledMatchError does not take     zend.exception_ignore_args=1 into account). (timwolla)
    * Fix fallback paths in fast_long_{add,sub}_function. (nielsdos)
    * Fixed bug [GH-17718](https://github.com/php/php-src/issues/17718) (Calling static methods on an     interface that has `__callStatic` is allowed). (timwolla)
    * Fixed bug [GH-17797](https://github.com/php/php-src/issues/17797) (zend_test_compile_string crash on     invalid script path). (David Carlier)
    * Fixed [GHSA-rwp7-7vc6-8477](https://github.com/php/php-src/security/advisories/GHSA-rwp7-7vc6-8477)     (Reference counting in php_request_shutdown causes Use-After-Free). (**CVE-2024-11235**) (ilutov)

    **DOM:**

    * Fixed bug [GH-17847](https://github.com/php/php-src/issues/17847) (xinclude destroys live node).
    (nielsdos)

    **FFI:**

    * Fix FFI Parsing of Pointer Declaration Lists. (davnotdev)

    **FPM:**

    * Fixed bug [GH-17643](https://github.com/php/php-src/issues/17643) (FPM with httpd ProxyPass encoded     PATH_INFO env). (Jakub Zelenka)

    **GD:**

    * Fixed bug [GH-17772](https://github.com/php/php-src/issues/17772) (imagepalettetotruecolor crash with     memory_limit=2M). (David Carlier)

    **LDAP:**

    * Fixed bug [GH-17704](https://github.com/php/php-src/issues/17704) (ldap_search fails when $attributes     contains a non-packed array with numerical keys). (nielsdos, 7u83)

    **LibXML:**

    * Fixed [GHSA-wg4p-4hqh-c3g9](https://github.com/php/php-src/security/advisories/GHSA-wg4p-4hqh-c3g9)     (Reocurrence of php#72714). (nielsdos)
    * Fixed [GHSA-p3x9-6h7p-cgfc](https://github.com/php/php-src/security/advisories/GHSA-p3x9-6h7p-cgfc)     (libxml streams use wrong `content-type` header when requesting a redirected resource).
    (**CVE-2025-1219**) (timwolla)

    **MBString:**

    * Fixed bug [GH-17503](https://github.com/php/php-src/issues/17503) (Undefined float conversion in     mb_convert_variables). (cmb)

    **Opcache:**

    * Fixed bug [GH-17654](https://github.com/php/php-src/issues/17654) (Multiple classes using same trait     causes function JIT crash). (nielsdos)
    * Fixed bug [GH-17577](https://github.com/php/php-src/issues/17577) (JIT packed type guard crash).
    (nielsdos, Dmitry)
    * Fixed bug [GH-17899](https://github.com/php/php-src/issues/17899) (zend_test_compile_string with invalid     path when opcache is enabled). (David Carlier)
    * Fixed bug [GH-17868](https://github.com/php/php-src/issues/17868) (Cannot allocate memory with tracing     JIT). (nielsdos)

    **PDO_SQLite:**

    * Fixed [GH-17837](https://github.com/php/php-src/issues/17837) ()::getColumnMeta() on unexecuted     statement segfaults). (cmb)
    * Fix cycle leak in sqlite3 setAuthorizer(). (nielsdos)

    **Phar:**

    * Fixed bug [GH-17808](https://github.com/php/php-src/issues/17808): PharFileInfo refcount bug. (nielsdos)

    **PHPDBG:**

    * Partially fixed bug [GH-17387](https://github.com/php/php-src/issues/17387) (Trivial crash in phpdbg     lexer). (nielsdos)
    * Fix memory leak in phpdbg calling registered function. (nielsdos)

    **Reflection:**

    * Fixed bug [GH-15902](https://github.com/php/php-src/issues/15902) (Core dumped in     ext/reflection/php_reflection.c). (DanielEScherzer)

    **Standard:**

    * Fixed bug php#72666 (stat cache clearing inconsistent between file:// paths and plain paths). (Jakub     Zelenka)

    **Streams:**

    * Fixed bug [GH-17650](https://github.com/php/php-src/issues/17650) (realloc with size 0 in     user_filters.c). (nielsdos)
    * Fix memory leak on overflow in _php_stream_scandir(). (nielsdos)
    * Fixed [GHSA-hgf54-96fm-v528](https://github.com/php/php-src/security/advisories/GHSA-hgf54-96fm-v528)     (Stream HTTP wrapper header check might omit basic auth header). (**CVE-2025-1736**) (Jakub Zelenka)
    * Fixed [GHSA-52jp-hrpf-2jff](https://github.com/php/php-src/security/advisories/GHSA-52jp-hrpf-2jff)     (Stream HTTP wrapper truncate redirect location to 1024 bytes). (**CVE-2025-1861**) (Jakub Zelenka)
    * Fixed [GHSA-pcmh-g36c-qc44](https://github.com/php/php-src/security/advisories/GHSA-pcmh-g36c-qc44)     (Streams HTTP wrapper does not fail for headers without colon). (**CVE-2025-1734**) (Jakub Zelenka)
    * Fixed [GHSA-v8xr-gpvj-cx9g](https://github.com/php/php-src/security/advisories/GHSA-v8xr-gpvj-cx9g)     (Header parser of `http` stream wrapper does not handle folded headers). (**CVE-2025-1217**) (Jakub     Zelenka)

    **Zlib:**

    * Fixed bug [GH-17745](https://github.com/php/php-src/issues/17745) (zlib extension incorrectly handles     object arguments). (nielsdos)
    * Fix memory leak when encoding check fails. (nielsdos)
    * Fix zlib support for large files. (nielsdos)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2ac2ddc2-0051-11f0-8673-f02f7432cf97 advisory.

    php.net reports:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.4.5 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PHP installed on the remote host is prior to 8.3.19. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.3.19 advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
233717	Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2025-922)	Nessus	Amazon Linux Local Security Checks	medium
233593	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : PHP vulnerabilities (USN-7400-1)	Nessus	Ubuntu Local Security Checks	medium
233397	SUSE SLES15 / openSUSE 15 Security Update : php7 (SUSE-SU-2025:1025-1)	Nessus	SuSE Local Security Checks	high
233395	SUSE SLES15 Security Update : php7 (SUSE-SU-2025:1026-1)	Nessus	SuSE Local Security Checks	high
233342	SUSE SLES15 / openSUSE 15 Security Update : php8 (SUSE-SU-2025:1012-1)	Nessus	SuSE Local Security Checks	high
233313	SUSE SLES15 Security Update : php8 (SUSE-SU-2025:0994-1)	Nessus	SuSE Local Security Checks	high
233171	Fedora 40 : php (2025-4e7e2c40e0)	Nessus	Fedora Local Security Checks	medium
233170	Fedora 41 : php (2025-8d0acf5a57)	Nessus	Fedora Local Security Checks	medium
232759	FreeBSD : php -- Multiple vulnerabilities (2ac2ddc2-0051-11f0-8673-f02f7432cf97)	Nessus	FreeBSD Local Security Checks	critical
232705	PHP 8.4.x < 8.4.5 Multiple Vulnerabilities	Nessus	CGI abuses	high
232704	PHP 8.3.x < 8.3.19 Multiple Vulnerabilities	Nessus	CGI abuses	high

Detections

Analytics

CVE-2024-11235

critical

Tenable Plugins

Coming Soon

medium

medium

high

high

high

high

medium

medium

critical

high

high