← Database

CVE-2026-25236

CRITICAL CVSS: 9.8 Published: 2026-02-03 Modified: 2026-06-17

Description

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe literal substitution for an IN (...) list. This issue has been patched in version 1.33.0.

Affected Platforms

Pear Pearweb

Weakness Type

CWE-89

References