HIGH🇵🇱 Wersja polska

CVE-2026-25235

CVSS 8.2v4.0pub. 2026-02-03upd. 2026-02-05

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess verification tokens and potentially verify election account requests without authorization. This issue has been patched in version 1.33.0.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Pear Pearweb

    APP
    Pear
    < 1.33.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-25241CRITICAL9.3PL ✓ten sam produkt

SQL injection w PEAR Pearweb — nieuwierzytelniony dostęp przez endpoint /get/

CVE-2026-25237CRITICAL9.2PL ✓ten sam produkt

RCE w PEAR Pearweb przez preg_replace() z modyfikatorem /e

CVE-2026-25238CRITICAL9.2PL ✓ten sam produkt

SQL Injection w PEAR Pearweb — podatność przy usuwaniu subskrypcji błędów

CVE-2026-25233HIGH7.1ten sam produkt

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in...

CVE-2026-25239HIGH8.2ten sam produkt

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL inject...