top-think/framework

GitHub

github.com

www.thinkphp.cn

Releases124

Frequency4 weeks 1 day

Last Release 5 months ago

Stars2.81K

ThinkPHP Framework

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2018-25270 ↗	Apr 22, 2026Wednesday, 22 April 2026, 16:16	9.8 CRITICAL	—
ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions through the routing parameter. Attackers can craft requests to the index.php endpoint with malicious function parameters to execute system commands with application privileges.
CVE-2024-34467 ↗	May 4, 2024Saturday, 4 May 2024, 20:15	6.1 MEDIUM	—
ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.
CVE-2022-47945 ↗	Dec 23, 2022Friday, 23 December 2022, 21:15	9.8 CRITICAL	—
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
CVE-2022-44289 ↗	Dec 6, 2022Tuesday, 6 December 2022, 16:15	8.8 HIGH	—
Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
CVE-2022-38352 ↗	Sep 15, 2022Thursday, 15 September 2022, 02:15	9.8 CRITICAL	—
ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
CVE-2022-33107 ↗	Jun 29, 2022Wednesday, 29 June 2022, 12:15	9.8 CRITICAL	7.5 HIGH
ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
CVE-2021-23592 ↗	May 6, 2022Friday, 6 May 2022, 20:15	7.7 HIGH	7.5 HIGH
The package topthink/framework before 6.0.12 are vulnerable to Deserialization of Untrusted Data due to insecure unserialize method in the Driver class.
CVE-2021-44350 ↗	Dec 15, 2021Wednesday, 15 December 2021, 23:15	9.8 CRITICAL	7.5 HIGH
SQL Injection vulnerability exists in ThinkPHP5 5.0.x <=5.1.22 via the parseOrder function in Builder.php.
CVE-2021-36564 ↗	Dec 6, 2021Monday, 6 December 2021, 21:15	9.8 CRITICAL	7.5 HIGH
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.
CVE-2021-36567 ↗	Dec 6, 2021Monday, 6 December 2021, 21:15	9.8 CRITICAL	10 HIGH
ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.
CVE-2018-16385 ↗	Sep 3, 2018Monday, 3 September 2018, 02:29	—	7.5 HIGH
ThinkPHP before 5.1.23 allows SQL Injection via the public/index/index/test/index query string.