Live › vulnerability › CVE-2026-112307
Go to dashboardsqlparse through 0.6.0 has an output filter that places unescaped dollar-sign sequences from SQL input into double-quoted PHP strings. An attacker who supplies crafted SQL text can get arbitrary PHP code to run when the generated snippet executes.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use sqlparse and feed user-supplied SQL into its PHP output filter, so the generated PHP snippet is executed. Projects that only use sqlparse to format or parse SQL with the default output, or that never run generated PHP, are unlikely to be exposed. The sources do not say more.
No product ranges from the sources yet.
0.6.0 or earlier, for example with pip show sqlparse.0.6.0; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
This page as .md · .json · in your agent: get_signal("CVE-2026-112307")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.