CVE-2026-25235 describes a vulnerability in PEAR (PHP Extension and Application Repository) versions prior to 1.33.0, specifically impacting the pearweb component. The flaw, categorized as CWE-337 (Predictable Pseudorandom Number Generator), allows attackers to guess predictable verification hashes, potentially enabling unauthorized verification of election account requests. This vulnerability carries a CVSSv3.1 score of 7.5 (HIGH), indicating a critical risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality. No user interaction or privileges are required for exploitation. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting a low level of public awareness or immediate threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.33.0CPE matchmatch criteria | cpe:2.3:a:pear:pearweb:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.