Explore

Latest Releases
Registries
Security Advisories
CollectionsPreview

Theme

Contact© 2026 Release Alert

Security Advisories

CVEs affecting projects tracked on Release Alert, from NVD & OSV.

© 2026 Release Alert

Privacy Policy
Terms of Service
Contact

CVE-2023-0567 — HIGH severity vulnerability | Release Alert

CVE-2023-0567

7.7

HIGHCVSS v3

Published

March 1, 2023

Affected

7 projects

Assigned by

[email protected]

Severity scale

010

Description

In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, password_verify() function may accept some invalid Blowfish hashes as valid. If such invalid hash ever ends up in the password database, it may lead to an application allowing any password for this entry as valid.

GitHubThe PHP Interpreter

NVD

NPM

>= 8.2.0, < 8.2.3, >= 8.1.0, < 8.1.16, >= 8.0.0, < 8.0.28NVD

NPMLezer-based PHP grammar

More on this CVE

NVD↗GitHub Advisory↗

>= 8.2.0, < 8.2.3, >= 8.1.0, < 8.1.16, >= 8.0.0, < 8.0.28NVD

lezer-parser/php

GitHubPHP grammar for Lezer.

>= 8.2.0, < 8.2.3, >= 8.1.0, < 8.1.16, >= 8.0.0, < 8.0.28NVD

Crates.ioRust bindings for the PHP runtime

>= 8.2.0, < 8.2.3, >= 8.1.0, < 8.1.16, >= 8.0.0, < 8.0.28NVD

NPMAllows you to run PHP code in Node.js in various ways.

>= 8.2.0, < 8.2.3, >= 8.1.0, < 8.1.16, >= 8.0.0, < 8.0.28NVD

Python Package IndexHandle some of the strange standards in PHP projects

>= 8.2.0, < 8.2.3, >= 8.1.0, < 8.1.16, >= 8.0.0, < 8.0.28NVD