CVE-2025-43717
In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST parameters, leading to XSS.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.4
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- EPSS probability
- 0.32%
- CWE
- CWE-531
- Published
- 2025-04-17
- Last modified
- 2026-03-13
Affected products
- avb HTTP_Request2
Weakness type
Related vulnerabilities
- CVE-2024-42213 — HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment