CVE-2025-1735

7.5 highEPSS 1.2%

High (7.5) in php php. EPSS 1.2% chance of exploitation in the next 30 days.

In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWEs: CWE-89, CWE-476
Published: 2025-07-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

php:php

References

https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3
http://www.openwall.com/lists/oss-security/2025/07/11/4
https://lists.debian.org/debian-lts-announce/2025/07/msg00017.html

Check your stack JSON