GCVE-110-COMPOSER-2026-041176

Advisory Published

Vulnetix · Advisory published October 13, 2026

[PHP-SHELL-EXEC-VAR] PHP OS command execution sink invoked on a variable — matched: $output = shell_exec($cmd) ?? '';

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Vendor	Product	Versions	Platforms
packagist	dskripchenko/php-pdf	v1.2.0 (affected), 1.13.0 (affected), 1.14.0 (affected)	—

advisory

web

3,167 records in the GCVE database · Updated October 13, 2026

No matching records found.

Investigate this vulnerability in the interactive console or download the raw GCVE record.