{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: ThinkPHP vulnerabilities","home_page_url":"https://patchfirst.co/vendor/thinkphp/","feed_url":"https://patchfirst.co/feed/vendor/thinkphp.json","description":"New and newly exploited ThinkPHP CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2018-25270","url":"https://patchfirst.co/cve/CVE-2018-25270/","title":"CVE-2018-25270: ThinkPHP 5.0.23 Remote Code Execution via invokefunction","content_text":"Thinkphp · ThinkPHP. Not in CISA KEV. EPSS 0.9% (higher than 59.3% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 65.8 of 100.","summary":"ThinkPHP 5.0.23 Remote Code Execution via invokefunction","date_published":"2026-04-22T00:00:00.000Z","date_modified":"2026-04-22T15:59:29.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":65.8,"kev":null,"epss":{"score":0.0089,"percentile":0.59341},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Thinkphp","product":"ThinkPHP","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2018-20062#kev","url":"https://patchfirst.co/cve/CVE-2018-20062/","title":"[KEV] CVE-2018-20062: ThinkPHP \"noneCms\" Remote Code Execution Vulnerability","content_text":"ThinkPHP · noneCms. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.95% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Named in 1 threat report. Priority 73.7 of 100.","summary":"ThinkPHP \"noneCms\" Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T01:52:14.000Z","tags":["kev","public-exploit","T1059","T1190"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.9953,"percentile":0.99946},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"ThinkPHP","product":"noneCms","techniqueIds":["T1059","T1190"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2019-9082#kev","url":"https://patchfirst.co/cve/CVE-2019-9082/","title":"[KEV] CVE-2019-9082: ThinkPHP Remote Code Execution Vulnerability","content_text":"ThinkPHP · ThinkPHP. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 97.4% (higher than 99.9% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1059 Command and Scripting Interpreter. Priority 69.1 of 100.","summary":"ThinkPHP Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:43:02.000Z","tags":["kev","public-exploit","T1059"],"_patchfirst":{"reason":"kev","priority":69.1,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.97419,"percentile":0.99899},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"ThinkPHP","product":"ThinkPHP","techniqueIds":["T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}}]}