CVE-2026-25234

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25234", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-30T14:44:47.328Z", "datePublished": "2026-02-03T18:29:19.724Z", "dateUpdated": "2026-02-04T21:15:38.932Z"}, "containers": {"cna": {"title": "PEAR is Vulnerable to SQL Injection in Category Deletion", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/pear/pearweb/security/advisories/GHSA-q28j-3p7r-6722", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pear/pearweb/security/advisories/GHSA-q28j-3p7r-6722"}], "affected": [{"vendor": "pear", "product": "pearweb", "versions": [{"version": "< 1.33.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T18:29:19.724Z"}, "descriptions": [{"lang": "en", "value": "PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow an attacker with access to the category manager workflow to inject SQL via a category id. This issue has been patched in version 1.33.0."}], "source": {"advisory": "GHSA-q28j-3p7r-6722", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T21:15:18.473435Z", "id": "CVE-2026-25234", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:15:38.932Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25234", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T21:15:18.473435Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T21:15:36.091Z"}}], "cna": {"title": "PEAR is Vulnerable to SQL Injection in Category Deletion", "source": {"advisory": "GHSA-q28j-3p7r-6722", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "pear", "product": "pearweb", "versions": [{"status": "affected", "version": "< 1.33.0"}]}], "references": [{"url": "https://github.com/pear/pearweb/security/advisories/GHSA-q28j-3p7r-6722", "name": "https://github.com/pear/pearweb/security/advisories/GHSA-q28j-3p7r-6722", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow an attacker with access to the category manager workflow to inject SQL via a category id. This issue has been patched in version 1.33.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T18:29:19.724Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25234", "state": "PUBLISHED", "dateUpdated": "2026-02-04T21:15:38.932Z", "dateReserved": "2026-01-30T14:44:47.328Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T18:29:19.724Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "pearweb", "vendor": "pear", "versions": [{"status": "affected", "version": "< 1.33.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pear:pearweb:*:*:*:*:*:*:*:*", "matchCriteriaId": "9C609AFE-4E3A-4103-9AA0-9CEA5D0D87AD", "versionEndExcluding": "1.33.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow an attacker with access to the category manager workflow to inject SQL via a category id. This issue has been patched in version 1.33.0."}, {"lang": "es", "value": "PEAR es un framework y sistema de distribuci\u00f3n para componentes PHP reutilizables. Antes de la versi\u00f3n 1.33.0, una vulnerabilidad de inyecci\u00f3n SQL en la eliminaci\u00f3n de categor\u00edas puede permitir a un atacante con acceso al flujo de trabajo del gestor de categor\u00edas inyectar SQL a trav\u00e9s de un ID de categor\u00eda. Este problema ha sido parcheado en la versi\u00f3n 1.33.0."}], "id": "CVE-2026-25234", "lastModified": "2026-06-17T10:24:21.057", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25234", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T21:15:18.473435Z", "version": "2.0.3"}}]}, "published": "2026-02-03T19:16:23.203", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pear/pearweb/security/advisories/GHSA-q28j-3p7r-6722"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:11:02.224915+00:00", "value": {"mitigation_remediation": ["Upgrade PEAR pearweb to version 1.33.0 or later", "Restrict access to the category manager workflow to trusted users only", "Implement input validation or parameterized queries for category identifiers", "Monitor web application logs for attempts to inject SQL commands"], "summary": {"action": "Apply Patch", "impact": "Database Compromise via SQL Injection"}, "threat_synthesis": {"affected_systems": "The issue is present in all releases of PEAR\u2019s pearweb component before version 1.33.0. Peart is a framework that ships PHP components. The only affected product is pearweb; no explicit list of operating systems is given, so the vulnerability exists wherever the vulnerable pearweb application is deployed as long as the attacker can access the category manager.", "description_and_impact": "The vulnerability is a classic SQL injection (CWE-89) that occurs when the category deletion endpoint accepts a category ID without proper sanitization. An attacker who can reach the category manager interface can inject arbitrary SQL through the ID field, potentially reading, modifying, or deleting data in the underlying database. This could expose sensitive data, alter business logic, or disrupt service.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity; the EPSS score is less than 1\u202f%, suggesting that exploit attempts are rare at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to authenticate or otherwise gain access to the category manager workflow, making the attack vector more local. Based on the description, it is inferred that local access is required because the vulnerability is tied to category manager workflow rather than exposed publicly. If those conditions are met, the attacker can inject SQL statements to manipulate database contents."}}}}, "created": "2026-02-04T12:08:41.101304+00:00", "updated": "2026-04-18T14:15:04.134214+00:00", "vendors": ["pear", "pear$PRODUCT$pearweb"]}