CVE-2025-43717

Published: Apr 17, 2025Modified: Jun 17, 2026Deferred

5.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Exploitability: 2.2 / Impact: 2.7

Source: MITRE (Secondary)

Description

In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS.

Related CWEs

CWE-531

Inclusion of Sensitive Information in Test Code

Accessible test applications can pose a variety of security risks. Since developers or administrators rarely consider that someone besides themselves would even know about the existence of these applications, it is common for them to contain sensitive information or functions.

References (4)

https://github.com/pear/HTTP_Request2/blob/b1c61b71128045734d757c4d3d436457ace80ea7/package.xml#L24

Source: cve@mitre.org

https://github.com/pear/HTTP_Request2/commit/07925aa77e441dba0ff0fa973a09802729cb838f

Source: cve@mitre.org

https://github.com/pear/HTTP_Request2/commit/265e05f9e08a28a38a57219516a8e4e2dfdbb147

Source: cve@mitre.org

https://github.com/pear/HTTP_Request2/compare/v2.6.0...v2.7.0

Source: cve@mitre.org

Timeline

No history available yet.