GitHub Advisoryadvisory · Packagist

GHSA-w7gh-f2fm-9q8r PEAR HTTP_Request2 vulnerable to Cross-site Scripting

MEDIUM Published 2025-04-17 Modified 2025-04-17 Official page ↗
Aliases
CVE-2025-43717
Ecosystem
Packagist
Packages
pear/http_request2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-531, CWE-79
Reviewed
2025-04-17

Affected packages

• Packagist pear/http_request2: < 2.7.0 → fixed in 2.7.0

Description

In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS.

Related

Alias · CVE (1)

  • CVE-2025-43717 In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and… vulnerability

Weakness · CWE (2)

  • CWE-531 Inclusion of Sensitive Information in Test Code weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References