PHPackages                             psecio/versionscan - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. psecio/versionscan

ActiveLibrary[Security](/categories/security)

psecio/versionscan
==================

A PHP version scanner for reporting possible vulnerabilities

1.5.4(7y ago)25156.4k23[3 issues](https://github.com/psecio/versionscan/issues)1MITPHPPHP >=5.3.1CI failing

Since Dec 15Pushed 6y ago11 watchersCompare

[ Source](https://github.com/psecio/versionscan)[ Packagist](https://packagist.org/packages/psecio/versionscan)[ Docs](https://github.com/psecio/versionscan.git)[ RSS](/packages/psecio-versionscan/feed)WikiDiscussions master Synced 1mo ago

READMEChangelogDependencies (4)Versions (19)Used By (1)

versionscan
===========

[](#versionscan)

[![Build Status](https://camo.githubusercontent.com/1f6fc975acaf96ef947f0479e46da2e1204fa50ad92cab98d3646cb8ccd0dc73/68747470733a2f2f7365637572652e7472617669732d63692e6f72672f70736563696f2f76657273696f6e7363616e2e706e673f6272616e63683d6d6173746572)](http://travis-ci.org/psecio/versionscan)[![Total Downloads](https://camo.githubusercontent.com/d3a3ce8d56a0fff2f7a5775fa24aacf2a262c9e35fde43a861477096fae04d10/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f70736563696f2f76657273696f6e7363616e2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/psecio/versionscan)

Versionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues.

**PLEASE NOTE:** Work is still in progress to adapt the tool to linux distributions that backport security fixes. As of right now, this only reports back for the straight up version reported.

Installation
------------

[](#installation)

### Using Composer

[](#using-composer)

```
{
    "require": {
        "psecio/versionscan": "dev-master"
    }
}

```

The only current dependency is the Symfony console.

Usage
-----

[](#usage)

To run the scan against your current PHP version, use:

`bin/versionscan`

The script will check the `PHP_VERSION` for the current instance and generate the pass/fail results. The output looks similar to:

```
Executing against version: 5.4.24
+--------+---------------+------+------------------------------------------------------------------------------------------------------+
| Status | CVE ID        | Risk | Summary                                                                                              |
+--------+---------------+------+------------------------------------------------------------------------------------------------------+
| FAIL   | CVE-2014-3597 | 6.8  | Multiple buffer overflows in the php_parserr function in ext/standard/dns.c in PHP before 5.4.32 ... |
| FAIL   | CVE-2014-3587 | 4.3  | Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in... |

```

Results will be reported back colorized as well to easily show the pass/fail of the check.

Parameters
----------

[](#parameters)

There are several parameters that can be given to the tool to configure its scans and results:

### PHP Version

[](#php-version)

If you'd like to define a PHP version to check other than the one the script finds itself, you can use the `php-version` parameter:

```
bin/versionscan scan --php-version=4.3.2

```

### Report Only Failures

[](#report-only-failures)

You can also tell the versionscan to only report back the failures and not the passing tests:

```
bin/versionscan scan --fail-only

```

### Sorting results

[](#sorting-results)

You can also sort the results either by the CVE ID or by severity (risk rating), with the `sort` parameter and either the "cve" or "risk" value:

```
bin/versionscan scan --sort=risk

```

### Output formats

[](#output-formats)

By default *versionscan* will output information directly to the console in a human-readable result. You can also specify other output formats that may be easier to parse programatically (like JSON). Use the `--format` option to change the output:

```
vendor/bin/versionscan scan --php-version=5.5 --format=json

```

Supported output formats are `console`, `json`, `xml` and `html`.

The HTML output format requires an `--output` option of the directory to write the file:

```
vendor/bin/versionscan scan --php-version=5.5 --format=html --output=/var/www/output

```

The result will be written to a file named something like `versionscan-output-20150808.html`

###  Health Score

42

—

FairBetter than 90% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity44

Moderate usage in the ecosystem

Community25

Small or concentrated contributor base

Maturity67

Established project with proven stability

 Bus Factor2

2 contributors hold 50%+ of commits

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~122 days

Recently: every ~273 days

Total

17

Last Release

2572d ago

Major Versions

0.1 → 1.02014-09-02

### Community

Maintainers

![](https://www.gravatar.com/avatar/e3e9061cdcb718c070419cadac5c58261580bbb384d0c5db21e53501121f08a7?d=identicon)[enygma](/maintainers/enygma)

---

Top Contributors

[![enygma](https://avatars.githubusercontent.com/u/66796?v=4)](https://github.com/enygma "enygma (45 commits)")[![colinodell](https://avatars.githubusercontent.com/u/202034?v=4)](https://github.com/colinodell "colinodell (36 commits)")[![lightswitch05](https://avatars.githubusercontent.com/u/598803?v=4)](https://github.com/lightswitch05 "lightswitch05 (9 commits)")[![xsist10](https://avatars.githubusercontent.com/u/415488?v=4)](https://github.com/xsist10 "xsist10 (8 commits)")[![juliangut](https://avatars.githubusercontent.com/u/1104131?v=4)](https://github.com/juliangut "juliangut (4 commits)")[![minkbear](https://avatars.githubusercontent.com/u/233714?v=4)](https://github.com/minkbear "minkbear (4 commits)")[![paulofreitas](https://avatars.githubusercontent.com/u/667360?v=4)](https://github.com/paulofreitas "paulofreitas (3 commits)")[![ccornutt-duo](https://avatars.githubusercontent.com/u/45460579?v=4)](https://github.com/ccornutt-duo "ccornutt-duo (2 commits)")[![marcelsud](https://avatars.githubusercontent.com/u/380226?v=4)](https://github.com/marcelsud "marcelsud (1 commits)")

---

Tags

cvephpriskscanssecuritysecurityversionscannervulnerability

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/psecio-versionscan/health.svg)

```
[![Health](https://phpackages.com/badges/psecio-versionscan/health.svg)](https://phpackages.com/packages/psecio-versionscan)
```

###  Alternatives

[enlightn/security-checker

A PHP dependency vulnerabilities scanner based on the Security Advisories Database.

33732.2M110](/packages/enlightn-security-checker)[psecio/parse

A PHP Security Scanner

38070.3k1](/packages/psecio-parse)[psecio/iniscan

A scanner to evaluate php.ini security

1.5k64.0k2](/packages/psecio-iniscan)[mitnick/laravel-security

laravel-mitnick helps you secure your Laravel apps by setting various HTTP headers. it can help!

8111.7k1](/packages/mitnick-laravel-security)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)