CVE-2007-4010: PHP

Medium severity, CVSS 6.8. EPSS: 5.5% chance of exploitation in the next 30 days.

The win32std extension in PHP 5.2.3 does not follow safe_mode and disable_functions restrictions, which allows remote attackers to execute arbitrary commands via the win_shell_execute function.

Affected products

• PHP PHP: version 5.2.3 only

Published 2007-07-26. Last modified 2026-06-16.