CVE-2026-25233highCWE-783

CVE-2026-25233: falha de alta gravidade em pearweb

PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bug

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pearweb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.4%
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has been patched in version 1.33.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
pear · pearweb
CVEs relacionadas — pearweb

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25237CRITICALPEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update EmailsEPSS 0.5%CVE-2026-25241CRITICALPEAR is Vulnerable to SQL Injection in /get/<package>/<version> EndpointEPSS 0.4%CVE-2026-25240MEDIUMPEAR is Vulnerable to SQL Injection in user::maintains() Role IN() FilterEPSS 0.3%CVE-2026-25238CRITICALPEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email ValidationEPSS 0.3%CVE-2026-25236MEDIUMPEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal SubstitutionEPSS 0.3%CVE-2026-25234MEDIUMPEAR is Vulnerable to SQL Injection in Category DeletionEPSS 0.3%