0-9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
| Supplier | Product | Version (see Status) | Status CVE-2026-109618 | Status CVE-2026-109619 | Notes | Links |
|---|---|---|---|---|---|---|
| EasyPHP project | EasyPHP PHP Devserver Windows bundle | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown The project describes a portable PHP development environment with PHP, Apache and modular PHP/version tools. |
source | |
| EC-CUBE project | EC-CUBE | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The publisher registry provides PHP and direct runtime extension requirements for the explicitly alpha 4.4 sample. |
source 1 source 2 |
|
| EfficientIP | EfficientIP DNS and network automation product suite | Investigation | Investigation | CVE assessment: Trusted-party reporting to NCSC-NL indicates .php URL paths in these management interfaces; exact product scope, PHP runtime details and CVE applicability are unconfirmed, and no official vendor information is available. A trusted party reported to NCSC-NL that EfficientIP management interfaces for DNS and network automation products use .php URL paths; exact product scope and PHP runtime details are not publicly confirmed. |
Reported to NCSC-NL by trusted party; no official vendor information available. | |
| EGroupware GmbH / EGroupware project | EGroupware | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The publisher manifest declares PHP, runtime extensions, optional modules and separately versioned suite packages. |
source 1 source 2 |
|
| Elastic | Elasticsearch official PHP client | Investigation | Investigation | CVE assessment: Caller PHP runtime only; CVE match unknown Fresh v9.5.0 registry review corroborates PHP ^8.1 and transport ^9.0, and separates yaml/zip development dependencies from the runtime list. The broad guide still says PHP 7.4. |
source 1 source 2 |
|
| Endor; linked by Apache Friends | Endor browser LAMP sandbox / XAMPP for Browsers | Investigation | Investigation | CVE assessment: PHP Wasm scope; CVE match unknown Apache Friends links its browser bundle to Endor. Endor explicitly describes a browser-run Linux/Apache/MariaDB/PHP emulator and bundled phpMyAdmin. |
source 1 source 2 |
|
| Enhancesoft / osTicket project | osTicket | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project installation documentation requires a PHP-capable web server and explicitly lists compatible PHP versions. |
source | |
| EspoCRM project | EspoCRM | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The project explicitly requires PHP and distinguishes mandatory extensions, database alternatives and optional feature modules. |
source | |
| European Commission | EU Academy Moodle service (2023 evidence) | Investigation | Investigation | CVE assessment: Historical scope; current use unknown An archived 2023 EU article identifies EU Academy as Moodle-based. |
source 1 source 2 |
|
| European Commission / OpenEuropa contributors | OpenEuropa Authentication Drupal module | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Publisher metadata declares PHP and Drupal; the module integrates with EU Login. |
source 1 source 2 |
|
| European Commission / OpenEuropa contributors | OpenEuropa Content Drupal module | Investigation | Investigation | CVE assessment: PHP relationship confirmed; CVE match unknown Publisher metadata declares PHP and Drupal dependencies. |
source | |
| European Commission / OpenEuropa contributors | OpenEuropa Task Runner | Investigation | Investigation | CVE assessment: Dev/CI/admin scope; CVE match unknown Publisher describes a PHP task runner and declares its PHP floor. |
source | |
| ExpressionEngine project | ExpressionEngine | Vulnerable | Vulnerable | CVE assessment: Affected when deployed on an affected web-serving PHP runtime; product evidence establishes a PHP web application, web interface, web service or HTTP framework scope, and the PHP defect is below the application layer. The official 7.x requirements identify a PHP/MySQL CMS, required PHP modules and optional PHP-FPM integration. |
source |