CVE-2026-25240mediumCWE-89

CVE-2026-25240: falha de média gravidade em pearweb

PEAR is Vulnerable to SQL Injection in user::maintains() Role IN() Filter

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar pearweb

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains() when role filters are provided as an array and interpolated into an IN (...) clause. This issue has been patched in version 1.33.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
pear · pearweb
CVEs relacionadas — pearweb

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25237CRITICALPEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update EmailsEPSS 0.5%CVE-2026-25241CRITICALPEAR is Vulnerable to SQL Injection in /get/<package>/<version> EndpointEPSS 0.4%CVE-2026-25233HIGHPEAR Has a Roadmap Authorization Bypass via Operator Precedence BugEPSS 0.4%CVE-2026-25238CRITICALPEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email ValidationEPSS 0.3%CVE-2026-25236MEDIUMPEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal SubstitutionEPSS 0.3%CVE-2026-25234MEDIUMPEAR is Vulnerable to SQL Injection in Category DeletionEPSS 0.3%