Threat database

CVE-2026-25236 is a medium-severity SQL injection vulnerability affecting pearweb versions prior to 1.33.0. The flaw arises from improper neutralization of special elements in SQL commands, specifically unsafe literal substitution in karma queries for an IN (... ) list. This vulnerability allows an unauthenticated attacker to execute arbitrary SQL queries remotely without user interaction, potentially leading to limited data integrity impact. The issue has been patched in version 1.33.0. Although no known exploits are currently reported in the wild, organizations using vulnerable pearweb versions should prioritize updating to mitigate risk.

CVE-2026-25233 is a high-severity logic vulnerability in the PEAR pearweb system affecting versions prior to 1.33.0. The flaw is an operator precedence logic error in the roadmap role check, which allows non-lead maintainers to create, update, or delete roadmaps without proper authorization. This vulnerability does not require user interaction or elevated privileges beyond maintainer access and can be exploited remotely over the network. Although no known exploits are currently in the wild, the issue impacts the integrity of project management data within pearweb. The vulnerability has been patched in version 1.33.0, and organizations using affected versions should upgrade promptly. European organizations relying on PEAR components for PHP development or project management are at risk, especially those with active development teams using pearweb.