Pear
Pearweb: vulnerabilities and CVEs
Pearweb has 9 published vulnerabilities, 9 of them in the last 12 months. 3 are rated critical and 0 are listed by CISA as actively exploited.
CVEs9
Last 12 months9
Critical3
Actively exploited0
All vulnerabilities in the catalogue →⭐ Follow this technology
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-25241 | Critical (9.3) | 0.46% | — | Feb 3, 2026 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated SQL injection in the /get/<package>/<version> endpoint allows remote attackers to execute arbitrary… |
| CVE-2026-25240 | Medium (6.9) | 0.30% | — | Feb 3, 2026 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains() when role filters are provided as an array and interpolated… |
| CVE-2026-25239 | High (8.2) | 0.24% | — | Feb 3, 2026 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can allow query manipulation if an attacker can influence the… |
| CVE-2026-25238 | Critical (9.2) | 0.30% | — | Feb 3, 2026 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion may allow attackers to inject SQL via a crafted email value.… |
| CVE-2026-25237 | Critical (9.2) | 0.45% | — | Feb 3, 2026 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update email handling can enable PHP code execution if… |
| CVE-2026-25236 | Medium (6.9) | 0.30% | — | Feb 3, 2026 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe literal substitution for an IN (...) list. This issue has been… |
| CVE-2026-25235 | High (8.2) | 0.29% | — | Feb 3, 2026 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account… |
| CVE-2026-25234 | Medium (5.3) | 0.29% | — | Feb 3, 2026 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow an attacker with access to the category manager workflow to… |
| CVE-2026-25233 | High (7.1) | 0.36% | — | Feb 3, 2026 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintainers to create, update, or delete roadmaps. This issue has… |
🎯 How it gets exploited (ATT&CK techniques)
Number of CVEs of this technology mapped to each exploitation or primary-impact technique.