CVE-2026-25237criticalCWE-624

CVE-2026-25237: falha crítica em pearweb

PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emails

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pearweb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.5%
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if attacker-controlled content reaches the evaluated replacement. This issue has been patched in version 1.33.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
pear · pearweb
CVEs relacionadas — pearweb

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25241CRITICALPEAR is Vulnerable to SQL Injection in /get/<package>/<version> EndpointEPSS 0.4%CVE-2026-25233HIGHPEAR Has a Roadmap Authorization Bypass via Operator Precedence BugEPSS 0.4%CVE-2026-25240MEDIUMPEAR is Vulnerable to SQL Injection in user::maintains() Role IN() FilterEPSS 0.3%CVE-2026-25238CRITICALPEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email ValidationEPSS 0.3%CVE-2026-25236MEDIUMPEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal SubstitutionEPSS 0.3%CVE-2026-25234MEDIUMPEAR is Vulnerable to SQL Injection in Category DeletionEPSS 0.3%