CVE-2026-17543

CriticalCVSS 9.8

Published: 30/07/2026(UTC)Updated: 05/08/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.39%

31th percentile - higher than 31% of all known CVEs

Summary

In PHP (versions 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9), improper escaping of backslashes in attacker-supplied parameters allows trivial SQL injection.

Risk Assessment

An attacker can execute arbitrary SQL queries on the database, leading to data leakage, modification, or deletion.

Recommendation

Upgrade PHP to version 8.2.33, 8.3.33, 8.4.24, 8.5.9, or later.

Original NVD description (English source)

Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.