Cyber Resilience

CVE-2025-1219

Php 8.1.0 – 8.1.32

Public PoC
Published
30 March 2025
Modified
03 November 2025
Patch / advisory
View advisory
CVSS Score v4 6.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0072 51th percentile
Risk Priority 33 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-1219 is a medium-severity Inaccurate Source Code Comments (CWE-1116) vulnerability in Php Php. Its CVSS base score is 6.3 (Medium).

Operationally, ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

In PHP from 8.1.* before 8.1.32, from 8.2.* before 8.2.28, from 8.3.* before 8.3.19, from 8.4.* before 8.4.5, when requesting a HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when…

more

the requested resource performs a redirect. This may cause the resulting document to be parsed incorrectly or bypass validations.

CWE(s)
CWE-1116

Related Threats

CVEs Like This One

CVE-2025-1735Same product: Php Php
CVE-2026-7568Same product: Php Php
CVE-2025-14178Same product: Php Php
CVE-2023-0662Same product: Php Php
CVE-2023-0567Same product: Php Php
CVE-2026-7259Same product: Php Php
CVE-2026-17544Same product: Php Php
CVE-2023-0568Same product: Php Php
CVE-2024-11234Same product: Php Php
CVE-2025-6491Same product: Php Php

Affected Assets

php
php
8.1.0 — 8.1.32 · 8.2.0 — 8.2.28 · 8.3.0 — 8.3.19

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
prevents

Secure SDLC practices include code review and documentation standards that catch inaccurate comments.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
prevents

Secure development life cycle includes code review and documentation standards that reduce inaccurate comments.

A.8.28 Secure coding partial match
prevents

Secure coding practices typically mandate accurate, up-to-date comments as part of coding standards.

References