SEC.co
Emergency

By weakness (CWE)

CWE-176: related vulnerabilities

CVEs classified under CWE-176. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

Known exploited (KEV)CriticalHighMediumAll recent
  • CVE-2026-45062HIGH 8.1

    FrankenPHP, a PHP application server, contains a critical flaw in how it processes file extensions when request paths include non-ASCII characters. Versions 1.11.2 through 1.12.2 are vulnerable to an attack where an attacker can trick FrankenPHP into executing a non-PHP file as if it were PHP code. If your deployment allows file uploads or stores user-controlled content, an attacker could upload a malicious file and then craft a specially-formed URL to trigger code execution on your server. The vulnerability has been fixed in version 1.12.3.