CVE-2015-6527

Published: Jan 19, 2016Modified: May 6, 2026

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: NVD

Description

The php_str_replace_in_subject function in ext/standard/string.c in PHP 7.x before 7.0.0 allows remote attackers to execute arbitrary code via a crafted value in the third argument to the str_ireplace function.

Affected (14)

Products: Php: Php

Php

1 product

Php

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Php Php	Version 7.0.0
Php Php	Version 7.0.0 alpha1
Php Php	Version 7.0.0 alpha2
Php Php	Version 7.0.0 beta1
Php Php	Version 7.0.0 beta2
Php Php	Version 7.0.0 beta3
Php Php	Version 7.0.0 rc1
Php Php	Version 7.0.0 rc2
Php Php	Version 7.0.0 rc3
Php Php	Version 7.0.0 rc4
Php Php	Version 7.0.0 rc5
Php Php	Version 7.0.0 rc6
Php Php	Version 7.0.0 rc7
Php Php	Version 7.0.0 rc8