CVE-2007-5900: PHP

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

PHP before 5.2.5 allows local users to bypass protection mechanisms configured through php_admin_value or php_admin_flag in httpd.conf by using ini_set to modify arbitrary configuration variables, a different issue than CVE-2006-4625.

Affected products

• PHP PHP: up to and including 5.2.4

Published 2007-11-20. Last modified 2026-06-16.