|
70190
|
[SRD-6871] Sensi.Ai - Call data not logging to Hub [SRD-6871] Sensi.Ai - Call data not logging to HubSpot activity - Jira
[SRD-6871] Sensi.Ai - Call data not logging to HubSpot activity - Jira
[JY-20912] Fallback mechanism for users with active SF tokens for CRM Matching - Jira
[JY-20912] Fallback mechanism for users with active SF tokens for CRM Matching - Jira
JY-20915 add alias for EU by LakyLak · Pull Request #12105 · jiminny/app
JY-20915 add alias for EU by LakyLak · Pull Request #12105 · jiminny/app
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20915 add alias for EU by LakyLak · Pull Request #12105 · jiminny/app
JY-20915 add alias for EU by LakyLak · Pull Request #12105 · jiminny/app
Pipelines - jiminny/app
Pipelines - jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Jiminny
Jiminny
[JY-20879] Enable users to use their new activity types - Jira
[JY-20879] Enable users to use their new activity types - Jira
Sentry error
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
CloudWatch | eu-west-1
CloudWatch | eu-west-1
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=30d...
|
70190
|
|
78004
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
30D
30D
Add a search term
Edit operator for filter: is
is
Edit value for filter: is...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=30d...
|
78004
|
|
78005
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=30d...
|
78005
|
|
78006
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=30d...
|
78006
|
|
78007
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78007
|
|
78008
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78008
|
|
78009
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is
is
Edit value for filter: is
unresolved
Remove filter: is
Add a search term
Add a search term
Edit operator for filter: is
is
Add a search term
Edit value for filter: is
unresolved
Remove filter: is
Clear search query
Last Seen
Last Seen
Save as
Save as
Select all
Issue
Last Seen
Age
Trend
24h
24h
Events
Users
Priority
Assignee
Previous
Next...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78009
|
|
78010
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is
is
Edit value for filter: is
unresolved
Remove filter: is
Add a search term
Add a search term
Edit operator for filter: is
is
Add a search term
Edit value for filter: is
unresolved
Remove filter: is
Clear search query
Last Seen
Last Seen
Save as
Save as
Select all
Issue
Last Seen
Age
Trend...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78010
|
|
78011
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78011
|
|
78012
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78012
|
|
78013
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78013
|
|
78014
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78014
|
|
78015
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78015
|
|
78016
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78016
|
|
78017
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is
is
Edit value for filter: is
unresolved
Remove filter: is
Add a search term
Add a search term
Edit operator for filter: is
is...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78017
|
|
78018
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is
is
Edit value for filter: is
unresolved
Remove filter: is
Add a search term
Add a search term
Edit operator for filter: is
is
Add a search term
Edit value for filter: is
unresolved
Remove filter: is...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78018
|
|
78019
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78019
|
|
78020
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78020
|
|
78021
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78021
|
|
78022
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78022
|
|
78023
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is
is
Edit value for filter: is
unresolved
Remove filter: is...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78023
|
|
78024
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78024
|
|
78025
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface....
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78025
|
|
78026
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78026
|
|
78027
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78027
|
|
78028
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78028
|
|
78043
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Jiminny\Exceptions\RateLimitException: Hubspot returned 429 — jiminny — app
Jiminny\Exceptions\RateLimitException: Hubspot returned 429 — jiminny — app
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations...
|
Firefox
|
Jiminny\Exceptions\RateLimitException: Hubspot ret Jiminny\Exceptions\RateLimitException: Hubspot returned 429 — jiminny — app — Work...
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78043
|
|
78044
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is
is
Edit value for filter: is
unresolved
Remove filter: is
Add a search term
Add a search term
Edit operator for filter: is
is
Add a search term
Edit value for filter: is
unresolved
Remove filter: is
Clear search query
Last Seen
Last Seen
Save as
Save as
Select all
Issue
Last Seen
Age
Trend
24h
24h
Events
Users
Priority
Assignee
Previous
Next...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78044
|
|
78045
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is
is
Edit value for filter: is
unresolved
Remove filter: is
Add a search term
Add a search term
Edit operator for filter: is
is
Add a search term
Edit value for filter: is
unresolved
Remove filter: is
Clear search query
Last Seen
Last Seen
Save as
Save as
Select all
Issue
Last Seen
Age
Trend
24h
24h
Events
Users
Priority
Assignee
Select Issue
Jiminny\Component\MediaPipeline\Exceptions\MediaPipelineException
Jiminny\Component\MediaPipeline\Exceptions\MediaPipelineException...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78045
|
|
78046
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78046
|
|
78047
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78047
|
|
78050
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is
is
Edit value for filter: is
unresolved
Remove filter: is
Add a search term
Add a search term
Edit operator for filter: is
is
Add a search term
Edit value for filter: is
unresolved
Remove filter: is
Clear search query
Last Seen
Last Seen
Save as
Save as
Select all
Issue
Last Seen
Age
Trend
24h
24h...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78050
|
|
78051
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78051
|
|
78052
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78052
|
|
78053
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78053
|
|
78054
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term
Edit operator for filter: is
is
Edit value for filter: is
unresolved
Remove filter: is
Add a search term
Add a search term
Edit operator for filter: is
is
Add a search term
Edit value for filter: is
unresolved
Remove filter: is
Clear search query
Last Seen
Last Seen
Save as
Save as
Select all
Issue
Last Seen
Age
Trend
24h
24h
Events
Users
Priority
Assignee
Select Issue
Jiminny\Component\MediaPipeline\Exceptions\MediaPipelineException
Jiminny\Component\MediaPipeline\Exceptions\MediaPipelineException
Level: Error...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78054
|
|
78055
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78055
|
|
78056
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app
app
production, production-eu
production, production-eu
24H
24H
Add a search term...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78056
|
|
78057
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78057
|
|
78058
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78058
|
|
78059
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78059
|
|
78060
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78060
|
|
78071
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78071
|
|
78072
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78072
|
|
78073
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78073
|
|
78074
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78074
|
|
78075
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78075
|
|
78076
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics
Warnings
Warnings
User Feedback
User Feedback
Autofix
Autofix
Recently Run
Recently Run
All Views
All Views
Configure
Alerts Moved
Alerts
Moved
Feed
Pause real-time updates
Ask Seer
Ask Seer
/
Give Feedback
app...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78076
|
|
78077
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78077
|
|
78078
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Pipelines - jiminny/app
Pipelines - jiminny/app
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
Feed — jiminny — Sentry
Feed — jiminny — Sentry
Close tab
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
Text message from 087 787 8118 - [EMAIL] - Jiminny Mail
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
Skip to main content
Skip to main content
Toggle organization menu
Issues
Issues
Explore
Explore
Dashboards
Dashboards
Monitors
Monitors
Settings
Settings
Try Business
What's New
Help
[EMAIL]
Issues
Expand
Feed
Feed
Errors & Outages
Errors & Outages
Breached Metrics
Breached Metrics...
|
Firefox
|
Feed — jiminny — Sentry — Work
|
jiminny.sentry.io/issues/?environment=production&a jiminny.sentry.io/issues/?environment=production&environment=production-eu&project=82419&statsPeriod=24h...
|
78078
|