CVE-2026-25235highCWE-337

CVE-2026-25235: fallo de gravedad alta en pearweb

PEAR Has a Predictable Verification Hash in Election Account Requests

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear pearweb

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.2epss 0.3%
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
pear · pearweb
CVEs relacionadas — pearweb

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-25237CRITICALPEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update EmailsEPSS 0.5%CVE-2026-25241CRITICALPEAR is Vulnerable to SQL Injection in /get/<package>/<version> EndpointEPSS 0.4%CVE-2026-25233HIGHPEAR Has a Roadmap Authorization Bypass via Operator Precedence BugEPSS 0.4%CVE-2026-25240MEDIUMPEAR is Vulnerable to SQL Injection in user::maintains() Role IN() FilterEPSS 0.3%CVE-2026-25238CRITICALPEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email ValidationEPSS 0.3%CVE-2026-25236MEDIUMPEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal SubstitutionEPSS 0.3%