CVE-2026-25238criticalCWE-89

CVE-2026-25238: falha crítica em pearweb

PEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email Validation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pearweb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.3%
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion may allow attackers to inject SQL via a crafted email value. This issue has been patched in version 1.33.0.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
pear · pearweb
CVEs relacionadas — pearweb

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25237CRITICALPEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update EmailsEPSS 0.5%CVE-2026-25241CRITICALPEAR is Vulnerable to SQL Injection in /get/<package>/<version> EndpointEPSS 0.4%CVE-2026-25233HIGHPEAR Has a Roadmap Authorization Bypass via Operator Precedence BugEPSS 0.4%CVE-2026-25240MEDIUMPEAR is Vulnerable to SQL Injection in user::maintains() Role IN() FilterEPSS 0.3%CVE-2026-25236MEDIUMPEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal SubstitutionEPSS 0.3%CVE-2026-25234MEDIUMPEAR is Vulnerable to SQL Injection in Category DeletionEPSS 0.3%