CVE-2020-7059

PoC —

CVSS 3.1

9.1 critical

EPSS

7%p94

Published

Feb 10, 2020 (Feb 10, 2020)

Modified

Jun 17, 2026

Description

When using fgetss() function to read data with stripping tags, in PHP versions 7.2.x below 7.2.27, 7.3.x below 7.3.14 and 7.4.x below 7.4.2 it is possible to supply data that will cause this function to read past the allocated buffer. This may lead to information disclosure or crash.

Vendors: php tenable oracle opensuse debian
Products: php, tenable.sc, communications diameter signaling router, leap, debian linux
Weakness: CWE-125
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (7.1%)

In the news0 stories

No ingested article mentions this CVE yet.