← CVE Intelligence

CVE-2026-25236

PEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal Substitution PUBLISHED

Description (CNA)

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe literal substitution for an IN (...) list. This issue has been patched in version 1.33.0.

Affected (CNA)

Vendor / productVersions
pear / pearwebaffected < 1.33.0

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.