CVE-2015-5243: phpWhois arbitrary code execution via a crafted whois record

critical Affects brightlocal/phpwhois, david-garcia/phpwhois, ivankristianto/phpwhois, jsmitty12/phpwhois, kazist/phpwhois, phpwhois/phpwhois and 4 more. Feed 2026.10.28.3, updated 2026-10-28; published 2022-05-14; advisory modified 2024-04-23.

phpWhois arbitrary code execution via a crafted whois record

Package: brightlocal/phpwhois Composer
Affected versions: <=4.2.5
Fixed in: no fix recorded
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Published: 2022-05-14
Source: osv.dev

References

phpWhois arbitrary code execution via a crafted whois record

Package: david-garcia/phpwhois Composer
Affected versions: <=4.3.1
Fixed in: no fix recorded
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Published: 2022-05-14
Source: osv.dev

References

phpWhois arbitrary code execution via a crafted whois record

Package: ivankristianto/phpwhois Composer
Affected versions: <=4.3.0
Fixed in: no fix recorded
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Published: 2022-05-14
Source: osv.dev

References

phpWhois arbitrary code execution via a crafted whois record

Package: jsmitty12/phpwhois Composer
Affected versions: <5.1.0
Fixed in: 5.1.0
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Published: 2022-05-14
Source: osv.dev

References

phpWhois arbitrary code execution via a crafted whois record

Package: kazist/phpwhois Composer
Affected versions: <=4.2.6
Fixed in: no fix recorded
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Published: 2022-05-14
Source: osv.dev

References

phpWhois arbitrary code execution via a crafted whois record

Package: phpwhois/phpwhois Composer
Affected versions: <=4.2.5
Fixed in: no fix recorded
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Published: 2022-05-14
Source: osv.dev

References

phpWhois arbitrary code execution via a crafted whois record

Package: serluck/phpwhois Composer
Affected versions: <=4.2.6
Fixed in: no fix recorded
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Published: 2022-05-14
Source: osv.dev

References

phpWhois arbitrary code execution via a crafted whois record

Package: simple-updates/phpwhois Composer
Affected versions: <=1.0.0
Fixed in: no fix recorded
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Published: 2022-05-14
Source: osv.dev

References

phpWhois arbitrary code execution via a crafted whois record

Package: truckersmp/phpwhois Composer
Affected versions: <=4.3.1
Fixed in: no fix recorded
Severity: critical CVSS 9.8
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Published: 2022-05-14
Source: osv.dev

References

PHP Code Injection

Package: theonedemon/phpwhois Composer
Affected versions: <=4.2.5
Fixed in: no fix recorded
Severity: unknown
Exploitation: not on CISA KEV · EPSS 6% (93.5th percentile)
Source: friendsofphp

References

https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180425-01_phpWhois_Code_Execution

CWE-94

NVD record brightlocal/phpwhois advisories david-garcia/phpwhois advisories ivankristianto/phpwhois advisories jsmitty12/phpwhois advisories kazist/phpwhois advisories phpwhois/phpwhois advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2017-9841 KEV critical Code Injection in PHPUnit same weakness: CWE-94
CVE-2021-3129 KEV critical Unauthenticated remote code execution via insecure file handling in debug mode same weakness: CWE-94
CVE-2025-32432 KEV critical Craft CMS Allows Remote Code Execution same weakness: CWE-94
CVE-2018-7602 KEV critical A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and same weakness: CWE-94
CVE-2024-56145 KEV critical Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled same weakness: CWE-94
CVE-2025-54068 KEV critical Livewire is vulnerable to remote command execution during component property update hydrat same weakness: CWE-94