{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"xdebug","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":[],"id":"tcs_01M5NB3T3S5YNZB35WNHQTWHHM","modified_at":"2026-09-09T07:00:18.257405822Z","published_at":"2025-07-23T14:15:31.763Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2015-10141","https://security-tracker.debian.org/tracker/CVE-2015-10141"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2015-10141#Debian:13/xdebug","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2015-10141"}],"summary":"An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug l"}