CVE-2017-9841
CISA KEV
ACT NOW
Priority: 0.00
BB Relevance:
0/100
Published: N/A
Modified: N/A
First seen: 2026-10-29
Status: pending_score
Description
PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "<?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
CISA Known Exploited Vulnerability
Vendor / Product
PHPUnit — PHPUnit
Date Added
2022-02-15
Remediation Due
2022-08-15
https://nvd.nist.gov/vuln/detail/CVE-2017-9841