Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 23:15:26 +0000 CVE-2024-3096 — PHP function password_verify can erroneously return true when argument contains NUL https://vulnerability.circl.lu/vuln/cve-2024-3096 <p><strong>Affected:</strong> PHP Group PHP, php_group php</p> <p>In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.</p> <p><strong>Affected:</strong> PHP Group PHP, php_group php</p> <p>In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\x00), testing a blank string as the password via password_verify() will incorrectly return true.</p> https://vulnerability.circl.lu/vuln/cve-2024-3096