CVE-2026-25241 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, an unauthenticated SQL injection in the /get/<package>/<versi… |
CVE-2026-25240 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability can occur in user::maintains()… |
CVE-2026-25239 | High | 7.5 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in apidoc queue insertion can a… |
CVE-2026-25238 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in bug subscription deletion ma… |
CVE-2026-25237 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, use of preg_replace() with the /e modifier in bug update emai… |
CVE-2026-25236 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection risk exists in karma queries due to unsafe li… |
CVE-2026-25235 | High | 7.5 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, predictable verification hashes may allow attackers to guess… |
CVE-2026-25234 | Critical | 9.8 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, a SQL injection vulnerability in category deletion can allow… |
CVE-2026-25233 | Critical | 9.1 | 2026-02-03 | PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadmap role check allows non-lead maintaine… |
CVE-2022-24953 | Medium | 5.3 | 2022-02-17 | The Crypt_GPG extension before 1.6.7 for PHP does not prevent additional options in GPG calls, which presents a risk for certain environments and GPG versions. |
CVE-2017-5677 | Critical | 9.8 | 2017-02-06 | PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint, the root… |
CVE-2009-4111 | | | 2009-11-29 | Argument injection vulnerability in Mail/sendmail.php in the Mail package 1.1.14, 1.2.0b2, and possibly other versions for PEAR allows remote attackers to read… |
CVE-2009-4025 | | | 2009-11-29 | Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows remote attackers to e… |
CVE-2009-4024 | | | 2009-11-29 | Argument injection vulnerability in the ping function in Ping.php in the Net_Ping package before 2.4.5 for PEAR allows remote attackers to execute arbitrary sh… |
CVE-2009-4023 | | | 2009-11-29 | Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php) in the Mail package 1.1.14 for PEAR allows remote… |
CVE-2007-5934 | | | 2007-11-13 | The LOB functionality in PEAR MDB2 before 2.5.0a1 interprets a request to store a URL string as a request to retrieve and store the contents of the URL, which… |
CVE-2007-3628 | | | 2007-07-09 | Unspecified vulnerability in the fetch function in MDB2.php in PEAR Structures-DataGrid-DataSource-MDB2 0.1.9 and earlier allows attackers to "manipulate the g… |
CVE-2006-0932 | | | 2006-02-28 | Directory traversal vulnerability in zip.lib.php 0.1.1 in PEAR::Archive_Zip allows remote attackers to create and overwrite arbitrary files via certain crafted… |
CVE-2006-0931 | | | 2006-02-28 | Directory traversal vulnerability in PEAR::Archive_Tar 1.2, and other versions before 1.3.2, allows remote attackers to create and overwrite arbitrary files vi… |
CVE-2006-0869 | | | 2006-02-23 | Directory traversal vulnerability in the "remember me" feature in liveuser.php in PHP Extension and Application Repository (PEAR) LiveUser 0.16.8 and earlier a… |
CVE-2006-0868 | | | 2006-02-23 | Multiple unspecified injection vulnerabilities in unspecified Auth Container back ends for PEAR::Auth before 1.2.4, and 1.3.x before 1.3.0r4, allow remote atta… |
CVE-2005-4730 | | | 2005-12-31 | Unspecified vulnerability in PEAR Text_Password 1.0 has unknown impact and attack vectors, related to "problematic seeding" of the random number generator, pos… |