All packages
ThinkPHP vulnerabilities
3 known CVE vulnerabilities in ThinkPHP, translated and rated.
- CVE-2025-63888Critical
The read function in thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability.
- CVE-2024-44902Critical
A deserialization vulnerability in ThinkPHP versions 6.1.3 through 8.0.4 allows attackers to execute arbitrary code remotely. The issue stems from unsafe processing of input data during deserialization.
- CVE-2019-9082HighActively exploited
ThinkPHP before 3.2.4, as used in Open Source BMS v1.1.1 and other products, allows Remote Command Execution via public//?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]= followed by the command.