Phpunit Project Phpunit — known CVE vulnerabilities

Every CVE whose affected-product data names Phpunit Project Phpunit, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2017-9841 — CVSS 9.8 (critical) — actively exploited: Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST…
• CVE-2026-24765 — CVSS 7.8 (high): PHPUnit is a testing framework for PHP. A vulnerability has been discovered in versions prior to 12.5.8, 11.5.50, 10.5.62, 9.6.33, and…
• CVE-2026-41570 — CVSS 7.8 (high): PHPUnit is a testing framework for PHP. In versions 12.5.21 and 13.1.5, PHPUnit forwards PHP INI settings to child processes (used for…
• CVE-2013-4744 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in the PHPUnit extension before 3.5.15 for TYPO3 allows remote attackers to inject arbitrary web…