EXPOSURES › CVE-2026-17543
CVE-2026-17543
CRITICALImproper backslash escaping in PHP allows trivial SQL injection in versions prior to 8.2.33, 8.3.33, 8.4.24, and 8.5.9.
This SQL injection vulnerability enables attackers to bypass authentication, exfiltrate data, or alter database contents. DIB organizations must ensure their PHP environments are patched to the specified versions, as unpatched instances remain vulnerable to exploitation in the wild.
Shame score — A trivial SQL injection in a widely used language like PHP indicates a fundamental, avoidable coding flaw that leaves systems exposed to data theft and manipulation.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.