CVE-2018-5712

An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.

• CWE-79

• http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
• http://php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/bid/102742Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/104020Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040363Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1296Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=74782Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/01/msg00025.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3566-1/Third Party Advisory
• https://usn.ubuntu.com/3600-1/Third Party Advisory
• https://usn.ubuntu.com/3600-2/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.html
• http://php.net/ChangeLog-5.phpRelease Notes, Vendor Advisory
• http://php.net/ChangeLog-7.phpRelease Notes, Vendor Advisory
• http://www.securityfocus.com/bid/102742Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/104020Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1040363Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1296Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:2519
• https://bugs.php.net/bug.php?id=74782Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/01/msg00025.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3566-1/Third Party Advisory
• https://usn.ubuntu.com/3600-1/Third Party Advisory
• https://usn.ubuntu.com/3600-2/Third Party Advisory
• https://www.oracle.com/security-alerts/cpuapr2020.html

Published

Jan 16, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-5705Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The …
• CVE-2018-5706An issue was discovered in Octopus Deploy before 4.1.9. Any …
• CVE-2018-5708An issue was discovered on D-Link DIR-601 B1 2.02NA devices.…
• CVE-2018-5709An issue was discovered in MIT Kerberos 5 (aka krb5) through…
• CVE-2018-5710An issue was discovered in MIT Kerberos 5 (aka krb5) through…
• CVE-2018-5711gd_gif_in.c in the GD Graphics Library (aka libgd), as used …
• CVE-2018-5713In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.…
• CVE-2018-5714In Malwarefox Anti-Malware 2.72.169, the driver file (zam64.…
• CVE-2018-5715phprint.php in SugarCRM 3.5.1 has XSS via a parameter name i…
• CVE-2018-5716An issue was discovered in Reprise License Manager 11.0. Thi…8.1
• CVE-2018-5717Memory write mechanism in NCR S2 Dispenser controller before…
• CVE-2018-5718Improper restriction of write operations within the bounds o…