Vulnerabilidades de Thinkphp
CVEs publicadas que afetam produtos de Thinkphp: 4 registro(s), com severidade, exploração e correções.
CVE-2018-25270
Crítica · 9.8
CWE-639 22/04/2026
ThinkPHP 5.0.23 Remote Code Execution via invokefunction
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.
CVE-2025-63889
Alta · 7.5
CWE-125 20/11/2025
Out-of-bounds Read em Thinkphp
The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary files via crafted file path in a template value.
CVE-2025-63888
Crítica · 9.8
CWE-98 20/11/2025
PHP Remote File Inclusion em Thinkphp
The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
CVE-2019-9082
Alta · 8.8
KEV Urgente · 76 Exploit público CWE-94 24/02/2019
ThinkPHP Remote Code Execution Vulnerability
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.