Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Top exploited KEVs we tracked over the past 7 days: 1 CVE-2025-61882 - Oracle EBS 2 CVE-2026-10520 - Ivanti Sentry 3 CVE-2022-47945 - ThinkPHP 4 CVE-2026-20230 - Cisco UCM 5 CVE-2026-46817 - Oracle EBS 6 CVE-2026-20253 - Splunk
Post summary
The snippet identifies six CVEs as top exploited in the past week, indicating active exploitation trends but lacking deeper technical or mitigation information.
Top KEVs hitting KEVIntel sensors this week: 1. CVE-2021-41773 - 732 2. CVE-2022-47945 - 466 3. CVE-2025-55182 - 337 4. CVE-2026-0770 - 178 5. CVE-2026-63030 - 113 2,497 exploitation attempts from 500 source IPs across our sensors. Patch what attackers are actually exploiting.
Post summary
The report lists recent KEVs with documented exploitation attempts, highlighting widespread attacks and urging patching of the affected systems.
NØX Echo Lineage Signal: CVE-2022-47945 Entity: ThinkPHP Lineage: Public vulnerability → Observed exploitation Relationship: - ThinkPHP → CVE-2022-47945 → Evidence → Operational Risk Current State: DISCLOSED, ACTIVE_EXPLOITATION Watch: - New infrastructure
NØØT Security Alerts Classification: Critical CVE: CVE-2022-47945 Product: ThinkPHP Summary: VulnCheck reports real-world exploitation activity affecting ThinkPHP / ThinkPHP. Evidence: Active exploitation reported; Severe impact class; Live exploitation observed by VulnCheck canaries Impact: The vulnerability has a severe impact class such as code execution, authentication bypass, account takeover, or privilege escalation. Action: Prioritize vendor remediation, identify exposed affected systems, and investigate for evidence of exploitation when applicable. Date: 11 Apr 2024 Source: https://vulncheck.com/ #NØØT #CyberSecurity #InfoSec #ThreatIntelligence #CyberThreats #CVE #CyberDefense #ThinkPHP #CVE_2022_47945 #ActiveExploitation #Exploit
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | thinkphp | thinkphp | - | - | - |