IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.1High

CVE-2026-17543SQL injection in ext-pgsql via E'...' backslash breakout

PHP Group PHP Published: (3 months ago)

Description

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

Weakness (CWE): CWE-89

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
PHP Group PHP 8.2.* – < 8.2.33, 8.3.* – < 8.3.33, 8.4.* – < 8.4.24, 8.5.* – < 8.5.9

References and patches

CPE matches (NVD) (4)
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.33
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.3.0 < 8.3.33
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.4.0 < 8.4.24
  • cpe:2.3:a:php:php:*:*:*:*:*:*:*:* ≥ 8.5.0 < 8.5.9

Recent CVEs in the same product — PHP

9.2Critical
CVE-2026-109619 KEV

RCE via stale global state

PHP Group PHP; Siemens AX4; Siemens CADRA; Siemens Capital

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subs…

100%EPSS
9.2Critical
CVE-2026-109618 KEV

RCE via OOM corruption

PHP Group PHP; Siemens AX4; Siemens CADRA; Siemens Capital

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The s…

100%EPSS
4.3Medium
CVE-2026-91769

TLS Hostname Verification Falls Back to CN After SAN Mismatch

PHP Group PHP

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certifi…