PHP 4.0
Support for PHP 4.0 ended on 23/06/2001. There are no more security updates for this branch.
Latest version: 4.0.6, released on 23/06/2001
End of support: 23/06/2001
398 known vulnerabilities open in 4.0.6
Vulnerabilities in PHP 4.0
408 vulnerabilities from the NVD affect at least one version of this branch. Last checked on 03/11/2026.
- CVE-2012-1823, CVSS 3.1: 9.8, actively exploited: still open in 4.0.6
- CVE-2012-2688, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2012-2376, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2011-3268, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2009-4143, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2008-2051, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2008-2050, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2007-0910, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2006-4812, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2004-1065, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2004-1064, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2004-1063, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2004-1019, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2004-1018, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2004-0542, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2003-0861, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2003-0860, CVSS 2.0: 10.0: still open in 4.0.6
- CVE-2024-3566, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2019-9641, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2019-9023, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2019-9021, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2019-9020, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2018-7584, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2017-9226, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2017-9225, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2017-9224, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2017-8923, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2017-12933, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-9935, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-9138, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-9137, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-7417, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-7414, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-7413, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-7411, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-7129, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-7127, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-7126, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2016-7124, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-6296, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-6295, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-6294, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-6291, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-6290, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-6288, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-5773, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-5772, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2016-5771, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2016-5770, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2016-5769, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-5768, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-4543, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-4542, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-4541, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-4540, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-4539, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-4538, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-4537, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-3141, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2016-2554, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-8835, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-6835, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-6834, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-5589, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-4643, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-4642, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-4603, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-4602, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-4601, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-4600, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-4599, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2015-4116, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2014-9912, CVSS 3.0: 9.8: still open in 4.0.6
- CVE-2011-1939, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2008-2108, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2008-0599, CVSS 3.1: 9.8: still open in 4.0.6
- CVE-2007-5653, CVSS 2.0: 9.3: still open in 4.0.6
- CVE-2007-2844, CVSS 2.0: 9.3: still open in 4.0.6
- CVE-2006-4483, CVSS 2.0: 9.3: still open in 4.0.6
- CVE-2006-4482, CVSS 2.0: 9.3: still open in 4.0.6
- CVE-2006-3017, CVSS 2.0: 9.3: still open in 4.0.6
- CVE-2006-1017, CVSS 2.0: 9.3: still open in 4.0.6
- CVE-2017-11147, CVSS 3.1: 9.1: still open in 4.0.6
- CVE-2016-5114, CVSS 3.0: 9.1: still open in 4.0.6
- CVE-2016-1903, CVSS 3.0: 9.1: still open in 4.0.6
- CVE-2019-6977, CVSS 3.0: 8.8: still open in 4.0.6
- CVE-2018-10549, CVSS 3.0: 8.8: still open in 4.0.6
- CVE-2016-6297, CVSS 3.0: 8.8: still open in 4.0.6
- CVE-2016-4343, CVSS 3.1: 8.8: still open in 4.0.6
- CVE-2016-4342, CVSS 3.0: 8.8: still open in 4.0.6
- CVE-2016-5096, CVSS 3.0: 8.6: still open in 4.0.6
- CVE-2016-5095, CVSS 3.0: 8.6: still open in 4.0.6
- CVE-2016-5094, CVSS 3.0: 8.6: still open in 4.0.6
- CVE-2016-5093, CVSS 3.0: 8.6: still open in 4.0.6
- CVE-2016-3142, CVSS 3.0: 8.2: still open in 4.0.6
- CVE-2016-7412, CVSS 3.0: 8.1: still open in 4.0.6
- CVE-2016-6174, CVSS 3.0: 8.1: still open in 4.0.6
- CVE-2017-11628, CVSS 3.0: 7.8: still open in 4.0.6
- CVE-2016-6289, CVSS 3.0: 7.8: still open in 4.0.6
- CVE-2016-5399, CVSS 3.1: 7.8: still open in 4.0.6
And 308 more.
23 vulnerabilities of PHP have no version information in the NVD and are not assigned to any branch.
Known vulnerabilities in PHP
- PHP2Shell (CVE-2026-109618, CVE-2026-109619)
Get notified
Add PHP with your version and Erseni Patch writes to you about new versions, vulnerabilities in exactly your version and the end of support.
Already have an account? Log in and add PHP 4.0