Source Code Disclosure - PHP

Home/Alerts/Alert detail/

Risk:
Medium

Type:
Passive

CWE:
CWE-540

Summary: Application Source Code was disclosed by the web server - PHP

Solution: Ensure that application Source Code is not available with alternative extensions, and ensure that source code is not present within other files or data deployed to the web server, or served by the web server.

References: https://www.wsj.com/articles/BL-CIOB-2999

Top Security News

CISA orders federal agencies to secure Microsoft 365 tenants

Recorded Future CEO applauds "undesirable" designation by Russia

BeyondTrust fixes critical vulnerability in remote access, support solutions (CVE-2024-12356)

Google Chrome uses AI to analyze pages in new scam detection feature

Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack

Lazarus Group Spotted Targeting Nuclear Engineers with CookiePlus Malware

Exploit released for critical WhatsUp Gold RCE flaw, patch now

Microsoft fixes exploited zero-day (CVE-2024-49138)

Common Alerts

InformationalBase64 Disclosure

LowInsufficient Site Isolation Against Spectre Vulnerability

LowStrict-Transport-Security Max-Age Malformed (Non-compliant with Spec)

MediumCSP: style-src unsafe-hashes

HighPath Traversal

MediumInsecure JSF ViewState

MediumExponential Entity Expansion (Billion Laughs Attack)

HighSQL Injection - Hypersonic SQL

HighOut of Band XSS

MediumReferer Exposes Session ID

Latest CVE List

CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

CVE-2018-14933 NUUO NVRmini Devices OS Command Injection Vulnerability

CVE-2022-23227 NUUO NVRmini 2 Devices Missing Authentication Vulnerability

CVE-2019-11001 Reolink Multiple IP Cameras OS Command Injection Vulnerability

CVE-2021-40407 Reolink RLC-410W IP Camera OS Command Injection Vulnerability

CVE-2024-55956 Cleo Multiple Products Unauthenticated File Upload Vulnerability

CVE-2024-20767 Adobe ColdFusion Improper Access Control Vulnerability

CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability

CVE-2024-50623 Cleo Multiple Products Unrestricted File Upload Vulnerability

CVE-2024-49138 Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability

Common CWEs

CWE-628 Function Call with Incorrectly Specified Arguments

CWE-57 Path Equivalence: 'fakedir/../realdir/filename'

MediumCWE-273 Improper Check for Dropped Privileges

MediumCWE-778 Insufficient Logging

CWE-1248 Semiconductor Defects in Hardware Logic with Security-Sensitive Implications

HighCWE-309 Use of Password System for Primary Authentication

CWE-1110 Incomplete Design Documentation

CWE-72 Improper Handling of Apple HFS+ Alternate Data Stream Path

CWE-155 Improper Neutralization of Wildcards or Matching Symbols

MediumCWE-1275 Sensitive Cookie with Improper SameSite Attribute

Free security scan for your website

Don't show website scan report rating on the leaderboard