thinkphp thinkphp

Name: thinkphp thinkphp
Brand: thinkphp

productUS

cpe:2.3:a:thinkphp:thinkphp:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

16critical4high0medium0low

updated 2026-10-28

vulnerabilities (27)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-9082US	high8.8OT critical	97.4% (100th)	KEV	3.2.4	2019-02-24	< 3.2.4
CVE-2024-44902US	critical9.8	4.24% (91st)	Exploit	no fix	2024-09-09	6.1.3 → 8.0.4
CVE-2025-63888US	—	0.61% (49th)	Exploit	no fix	2025-11-20	= 5.0.24
CVE-2022-47945US	critical9.8	30.2% (98th)	—	6.0.14	2022-12-23	< 6.0.14
CVE-2022-33107US	critical9.8	23.9% (98th)	—	no fix	2022-06-29	= 6.0.12
CVE-2022-38352US	critical9.8	21.0% (98th)	—	no fix	2022-09-15	= 6.0.13
CVE-2022-25481US	high7.5	4.75% (92nd)	—	no fix	2022-03-21	= 5.0.24
CVE-2022-44289US	high8.8	3.07% (88th)	—	no fix	2022-12-06	2 versions
CVE-2021-36567US	critical9.8	2.49% (85th)	—	no fix	2021-12-06	= 6.0.8
CVE-2018-16385US	critical9.8	2.15% (82nd)	—	5.1.23	2018-09-03	< 5.1.23
CVE-2021-44892US	high8.8	2.02% (81st)	—	no fix	2022-02-10	= 3.2.3
CVE-2021-36564US	critical9.8	1.92% (80th)	—	no fix	2021-12-06	= 6.0.8
CVE-2020-20120US	critical9.8	1.82% (79th)	—	no fix	2021-09-28	≤ 3.2.3
CVE-2021-23592US	critical9.8	1.73% (78th)	—	6.0.12	2022-05-06	< 6.0.12
CVE-2018-18546US	critical9.8	1.66% (77th)	—	no fix	2018-10-21	= 3.2.4
CVE-2018-17566US	critical9.8	1.54% (75th)	—	no fix	2018-09-26	= 5.1.24
CVE-2021-44350US	critical9.8	1.42% (73rd)	—	no fix	2021-12-15	5.0.0 → 5.1.22
CVE-2022-45982US	critical9.8	1.23% (69th)	—	no fix	2023-02-08	2 versions
CVE-2018-18530US	critical9.8	1.20% (68th)	—	no fix	2018-10-19	= 5.1.25
CVE-2018-18529US	critical9.8	1.20% (68th)	—	no fix	2018-10-19	= 3.2.4
CVE-2025-50707US	—	1.11% (66th)	—	no fix	2025-08-05	= 3.2.5
CVE-2025-50706US	—	1.11% (66th)	—	no fix	2025-08-05	= 5.1.0
CVE-2018-10225US	critical9.8	1.10% (66th)	—	no fix	2018-04-19	= 3.1.3
CVE-2018-25270US	—	0.89% (59th)	—	5.0.23	2026-04-22	2 versions
CVE-2024-48112US	—	0.89% (59th)	—	no fix	2024-10-30	6.1.3 → 8.0.4
CVE-2024-34467US	—	0.42% (36th)	—	no fix	2024-05-04	= 8.0.3
CVE-2025-63889US	—	0.32% (25th)	—	no fix	2025-11-20	= 5.0.24

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-502Deserialization of Untrusted Data8 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')8 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')4 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-125Out-of-bounds Read1 CVEs
CWE-284Improper Access Control1 CVEs
CWE-306Missing Authentication for Critical Function1 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE27 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan