CVE-2026-3057

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3057", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-02-23T18:04:37.334Z", "datePublished": "2026-02-24T02:02:08.977Z", "dateUpdated": "2026-02-24T20:42:56.315Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-24T02:02:08.977Z"}, "title": "a54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "SQL Injection"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-74", "lang": "en", "description": "Injection"}]}], "affected": [{"vendor": "a54552239", "product": "pearProjectApi", "versions": [{"version": "2.8.0", "status": "affected"}, {"version": "2.8.1", "status": "affected"}, {"version": "2.8.2", "status": "affected"}, {"version": "2.8.3", "status": "affected"}, {"version": "2.8.4", "status": "affected"}, {"version": "2.8.5", "status": "affected"}, {"version": "2.8.6", "status": "affected"}, {"version": "2.8.7", "status": "affected"}, {"version": "2.8.8", "status": "affected"}, {"version": "2.8.9", "status": "affected"}, {"version": "2.8.10", "status": "affected"}], "cpes": ["cpe:2.3:a:a54552239:pearprojectapi:*:*:*:*:*:*:*:*"], "modules": ["Backend Interface"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-02-23T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-02-23T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-02-23T19:09:42.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "319398761 (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.347413", "name": "VDB-347413 | a54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347413", "name": "VDB-347413 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.757669", "name": "Submit #757669 | Github pearProject <=V2.8.10 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/XiaoyuZhou1997/CVE/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/XiaoyuZhou1997/CVE/issues/1#issue-3935708166", "tags": ["exploit", "issue-tracking"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-24T20:42:36.263663Z", "id": "CVE-2026-3057", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T20:42:56.315Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3057", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-24T20:42:36.263663Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-24T20:42:49.851Z"}}], "cna": {"title": "a54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection", "credits": [{"lang": "en", "type": "reporter", "value": "319398761 (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:a54552239:pearprojectapi:*:*:*:*:*:*:*:*"], "vendor": "a54552239", "modules": ["Backend Interface"], "product": "pearProjectApi", "versions": [{"status": "affected", "version": "2.8.0"}, {"status": "affected", "version": "2.8.1"}, {"status": "affected", "version": "2.8.2"}, {"status": "affected", "version": "2.8.3"}, {"status": "affected", "version": "2.8.4"}, {"status": "affected", "version": "2.8.5"}, {"status": "affected", "version": "2.8.6"}, {"status": "affected", "version": "2.8.7"}, {"status": "affected", "version": "2.8.8"}, {"status": "affected", "version": "2.8.9"}, {"status": "affected", "version": "2.8.10"}]}], "timeline": [{"lang": "en", "time": "2026-02-23T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-02-23T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-02-23T19:09:42.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.347413", "name": "VDB-347413 | a54552239 pearProjectApi Backend Task.php dateTotalForProject sql injection", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.347413", "name": "VDB-347413 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.757669", "name": "Submit #757669 | Github pearProject <=V2.8.10 SQL Injection", "tags": ["third-party-advisory"]}, {"url": "https://github.com/XiaoyuZhou1997/CVE/issues/1", "tags": ["issue-tracking"]}, {"url": "https://github.com/XiaoyuZhou1997/CVE/issues/1#issue-3935708166", "tags": ["exploit", "issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "SQL Injection"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-24T02:02:08.977Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3057", "state": "PUBLISHED", "dateUpdated": "2026-02-24T20:42:56.315Z", "dateReserved": "2026-02-23T18:04:37.334Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-02-24T02:02:08.977Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:a54552239:pearprojectapi:*:*:*:*:*:*:*:*"], "modules": ["Backend Interface"], "product": "pearProjectApi", "vendor": "a54552239", "versions": [{"status": "affected", "version": "2.8.0"}, {"status": "affected", "version": "2.8.1"}, {"status": "affected", "version": "2.8.2"}, {"status": "affected", "version": "2.8.3"}, {"status": "affected", "version": "2.8.4"}, {"status": "affected", "version": "2.8.5"}, {"status": "affected", "version": "2.8.6"}, {"status": "affected", "version": "2.8.7"}, {"status": "affected", "version": "2.8.8"}, {"status": "affected", "version": "2.8.9"}, {"status": "affected", "version": "2.8.10"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:a54552239:pearprojectapi:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8CA8A8E-5710-471B-AD4F-687EFD363E68", "versionEndIncluding": "2.8.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se ha descubierto una vulnerabilidad de seguridad en a54552239 pearProjectApi hasta la versi\u00f3n 2.8.10. Afecta a la funci\u00f3n dateTotalForProject del archivo application/common/Model/Task.PHP del componente Interfaz de Backend. Si se manipula el argumento projectCode se puede provocar una inyecci\u00f3n SQL. El ataque puede lanzarse de forma remota. El exploit ha sido publicado y puede ser utilizado para ataques. El proveedor fue contactado con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-3057", "lastModified": "2026-06-17T10:42:58.373", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3057", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-24T20:42:36.263663Z", "version": "2.0.3"}}]}, "published": "2026-02-24T03:16:03.190", "references": [{"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/XiaoyuZhou1997/CVE/issues/1"}, {"source": "cna@vuldb.com", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://github.com/XiaoyuZhou1997/CVE/issues/1#issue-3935708166"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/?ctiid.347413"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?id.347413"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/?submit.757669"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-89"}], "source": "cna@vuldb.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.10"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "pearProjectApi", "source": "cna", "vendor": "a54552239"}, "product": "pearprojectapi", "vendor": "a54552239"}], "analysis": {"en": {"generated_at": "2026-04-18T10:58:42.144106+00:00", "value": {"mitigation_remediation": ["Upgrade pearProjectApi to a version newer than 2.8.10 once available", "If an upgrade is not immediately possible, implement input validation to ensure projectCode contains only expected characters", "Modify the data access layer to use parameterized queries or prepared statements, eliminating direct string interpolation of projectCode", "Restrict API access to authenticated and authorized users only", "Monitor database logs for abnormal query patterns indicative of injection attempts"], "summary": {"action": "Apply Workaround", "impact": "Remote SQL Injection"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the pearProjectApi product, version 2.8.10 and earlier. No later versions are disclosed as patched. Users running any supported release prior to 2.8.10 are at risk.", "description_and_impact": "A security flaw exists in the pearProjectApi back\u2011end component. The dateTotalForProject function in Task.php accepts a projectCode parameter without proper sanitization, enabling an attacker to inject arbitrary SQL statements. This flaw aligns with CWE\u201174 (SQL Injection) and CWE\u201189 (Improper neutralization of special elements in an SQL command). If exploited, the attacker can read, modify, or delete data within the database, compromising confidentiality and integrity.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate impact. The EPSS score of less than 1% suggests that automated exploitation is currently rare, yet public exploit code has been released, making manual attacks feasible. The vulnerability is not listed in the CISA KEV catalog, but the existence of public exploits increases the potential for targeted attacks. Attackers can trigger the flaw remotely by sending a crafted request containing a malicious projectCode value, which the unprotected SQL statement then executes on the server."}}}}, "created": "2026-02-24T09:53:29.336381+00:00", "updated": "2026-04-18T11:00:05.751731+00:00", "vendors": ["a54552239", "a54552239$PRODUCT$pearprojectapi"]}