PHPOK

Records24All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical8CVSS 9.0–10.0

CVSS high11CVSS 7.0–8.9

Exploited now

PHPOK records in CISA KEV

No PHPOK vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Phpok 21 records HIGH Oklite 2 records MEDIUM

Records

24 records

TI-2022-19467 CVE-2022-40889 · GHSA-62cv-fj2v-qxxf

Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php.

HIGH 82

Phpok 6.1 has a deserialization vulnerability via framework/phpok_call.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01247 Published 2022-10-18 No fix listed CWE-502

TI-2023-16596 CVE-2023-33601 · GHSA-9j68-h6gp-g4c7

An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows…

HIGH 73

An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP file.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00945 Published 2023-06-07 No fix listed CWE-434

TI-2021-13263 CVE-2021-34076 · GHSA-3jjm-rj9f-57mr

File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code…

HIGH 73

File Upload vulnerability in PHPOK 5.7.140 allows remote attackers to run arbitrary code and gain escalated privileges via crafted zip file upload.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00865 Published 2023-05-11 No fix listed CWE-434

TI-2024-30027 CVE-2024-44867 · GHSA-cqpj-cqf7-q68j

phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.

HIGH 72

phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01018 Published 2024-09-10 No fix listed CWE-22

TI-2020-14064 CVE-2020-21486 · GHSA-89hv-5x65-64rf

SQL injection vulnerability in PHPOK v.5.4.

HIGH 72

SQL injection vulnerability in PHPOK v.5.4.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00869 Published 2023-06-20 No fix listed CWE-89

TI-2023-02707 CVE-2023-2888 · GHSA-43v5-882w-9hpj

PHPOK unrestricted upload

HIGH 71

A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00694 Published 2023-05-25 No fix listed CWE-434

TI-2023-14056 CVE-2023-29881 · GHSA-848j-v22q-pr2m

phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php.

HIGH 68

phpok 6.4.003 is vulnerable to SQL injection in the function index_f() in phpok64/framework/api/call_control.php.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00415 Published 2024-05-09 No fix listed CWE-89

TI-2022-23335 CVE-2022-47129 · GHSA-x96f-hhvw-7xp6

PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.

MEDIUM 51

PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01192 Published 2023-05-11 No fix listed CWE-94

TI-2019-12121 CVE-2019-16131 · GHSA-rcjq-v77q-5648

framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload…

MEDIUM 47

framework/admin/modulec_control.php in OKLite v1.2.25 has an Arbitrary File Upload Vulnerability because a .php file from a ZIP archive can be written to /data/cache/.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.06522 Published 2019-09-09 No fix listed CWE-434

TI-2022-11858 CVE-2022-29363 · GHSA-2p5c-278v-ff2c

Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f()…

MEDIUM 45

Phpok v6.1 was discovered to contain a deserialization vulnerability via the update_f() function in login_control.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01315 Published 2022-05-12 No fix listed CWE-502

TI-2020-13390 CVE-2020-18440 · GHSA-g4j9-xc4c-6pmc

Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.

MEDIUM 45

Buffer overflow vulnerability in framework/init.php in qinggan phpok 5.1, allows attackers to execute arbitrary code.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01659 Published 2021-11-02 No fix listed CWE-120

TI-2020-12844 CVE-2020-16629 · GHSA-r4gr-8frm-x929

PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data…

MEDIUM 45

PhpOK 5.4.137 contains a SQL injection vulnerability that can inject an attachment data through SQL, and then call the attachment replacement function through api.php to write a PHP file to the target path.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01458 Published 2021-02-08 No fix listed CWE-89

TI-2018-08970 CVE-2018-12491 · GHSA-w9fq-993h-jqfp

PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in…

MEDIUM 45

PHPOK 4.9.032 has an arbitrary file upload vulnerability in the import_f function in framework/admin/modulec_control.php, as demonstrated by uploading a .php file within a .php.zip archive, a similar issue to CVE-2018-89…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.0163 Published 2018-06-15 No fix listed CWE-434

TI-2022-26711 CVE-2022-51023 · GHSA-hv8g-4wwm-c979

SQL injection in PHPOK via the api.php sort parameter

MEDIUM 44

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00262 Published 2026-10-22 Fixed in 5.4.081 CWE-89

TI-2018-06482 CVE-2018-8944 · GHSA-6qr4-3hx6-r5mx

PHPOK 4.8.338 has an arbitrary file upload vulnerability.

MEDIUM 44

PHPOK 4.8.338 has an arbitrary file upload vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01164 Published 2018-03-22 No fix listed CWE-434

TI-2018-13860 CVE-2018-19562 · GHSA-vq3p-q9j5-g733

An issue was discovered in PHPok 4.9.015.

MEDIUM 42

An issue was discovered in PHPok 4.9.015.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02214 Published 2018-11-26 No fix listed CWE-434

TI-2020-13389 CVE-2020-18439 · GHSA-xq42-73v3-g528

An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php…

MEDIUM 41

An issue was discoverered in in function edit_save_f in framework/admin/tpl_control.php in qinggan phpok 5.1, allows attackers to write arbitrary files or get a shell.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01007 Published 2021-11-02 No fix listed

TI-2020-13555 CVE-2020-19199 · GHSA-vfhj-mmg9-76p7

A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via…

MEDIUM 40

A Cross Site Request Forgery (CSRF) vulnerability exists in PHPOK 5.2.060 via admin.php?c=admin&f=save, which could let a remote malicious user execute arbitrary code.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00913 Published 2021-05-10 No fix listed CWE-352

TI-2019-12122 CVE-2019-16132 · GHSA-mp6c-g5wv-h2cv

An issue was discovered in OKLite v1.2.25.

LOW 38

An issue was discovered in OKLite v1.2.25.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.06123 Published 2019-09-09 No fix listed CWE-22

TI-2020-13388 CVE-2020-18438 · GHSA-3q66-gj8f-4pff

Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose…

LOW 36

Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0166 Published 2021-11-02 No fix listed CWE-22

TI-2018-08971 CVE-2018-12492 · GHSA-p2gc-xwq6-j33w

PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php.

LOW 35

PHPOK 4.9.032 has an arbitrary file deletion vulnerability in the delfile_f function in framework/admin/tpl_control.php.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00912 Published 2018-06-15 No fix listed CWE-20

TI-2018-14185 CVE-2018-20006 · GHSA-3qvp-r875-5wf2

An issue was discovered in PHPok v5.0.055.

LOW 28

An issue was discovered in PHPok v5.0.055.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00614 Published 2018-12-10 No fix listed CWE-79

TI-2018-11542 CVE-2018-16142 · GHSA-9qr3-c2g6-3m4c

PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via…

LOW 28

PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00692 Published 2018-08-30 No fix listed CWE-79

TI-2024-26119 CVE-2024-38953 · GHSA-f6gg-484j-ch5h

phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method…

LOW 27

phpok 6.4.003 contains a Cross Site Scripting (XSS) vulnerability in the ok_f() method under the framework/api/upload_control.php file.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00292 Published 2024-07-01 No fix listed CWE-79

Open these records in search →

Critical	8
High	11
Medium	5
Low	0
No CVSS	0