CVE-2020-7069

score

<0.1

cvss

5.4

epss

2.1%

published

2020-10-02

kev added

—

first seen

2026-10-21

PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23, and 7.4.x below 7.4.11 contain a cryptographic issue caused by improper IV handling in openssl_encrypt() when using AES-CCM mode with 12 bytes IV, letting attackers potentially weaken encryption security and cause data corruption, exploit requires using vulnerable PHP versions with AES-CCM mode.