CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.4. It affects Windows. Public exploit code or proof-of-concept references have been detected in its references. Its EPSS score suggests a 32.6% probability of exploitation in the next 30 days.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Related CVEs
Other vulnerabilities affecting the same vendor(s)