|
77287
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
....
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77287
|
|
77288
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy
No Fear Act Policy
|
FOIA
FOIA
|
Environmental Policy
Environmental Policy
|
Scientific Integrity
Scientific Integrity
|
Information Quality Standards
Information Quality Standards
|
Commerce.gov
Commerce.gov
|
Science.gov
Science.gov
|
USA.gov
USA.gov...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77288
|
|
77291
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy
No Fear Act Policy
|
FOIA
FOIA
|
Environmental Policy
Environmental Policy
|
Scientific Integrity
Scientific Integrity
|
Information Quality Standards
Information Quality Standards
|
Commerce.gov
Commerce.gov
|
Science.gov
Science.gov
|
USA.gov
USA.gov...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77291
|
|
77292
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy
No Fear Act Policy
|
FOIA
FOIA
|
Environmental Policy
Environmental Policy
|
Scientific Integrity
Scientific Integrity
|
Information Quality Standards
Information Quality Standards
|
Commerce.gov
Commerce.gov
|
Science.gov
Science.gov
|
USA.gov
USA.gov...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77292
|
|
77671
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77671
|
|
77672
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77672
|
|
77673
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:
[EMAIL]
[EMAIL]
Phone: 1-[PHONE]
Site Privacy
Site Privacy
|
Accessibility
Accessibility
|
Privacy Program
Privacy Program
|
Copyrights
Copyrights
|
Vulnerability Disclosure
Vulnerability Disclosure
|
No Fear Act Policy
No Fear Act Policy
|
FOIA
FOIA
|
Environmental Policy
Environmental Policy
|
Scientific Integrity
Scientific Integrity
|
Information Quality Standards
Information Quality Standards
|
Commerce.gov
Commerce.gov
|
Science.gov
Science.gov
|
USA.gov
USA.gov...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77673
|
|
77674
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77674
|
|
77675
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77675
|
|
77676
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Conversation with Gemini
Conversation with Gemini
Your move, Lukas!
Your move, Lukas!
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77676
|
|
77677
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Conversation with Gemini
Conversation with Gemini
Your move, Lukas!
Your move, Lukas!
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77677
|
|
77678
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin
(link is external)
youtube (link is external)
youtube
(link is external)
rss
rss
govdelivery (link is external)
govdelivery
(link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
[PHONE]
[PHONE]
Webmaster
Webmaster
|
Contact Us
Contact Us
|
Our Other Offices
Our Other Offices
Incident Response Assistance and Non-NVD Related
Technical Cyber Security Questions:
US-CERT Security Operations Center
Email:...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77678
|
|
77679
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
Ask Gemini
Ask Gemini
Upload & tools
Stop response
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Gemini replied
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group
X (link is external)
X
(link is external)
facebook (link is external)
facebook
(link is external)
linkedin (link is external)
linkedin...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77679
|
|
77680
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89:
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction.
When copying a string token containing a
NUL
byte,
the driver utilizes
strncat()
,
which terminates prematurely at the
NUL
byte.
This drops the closing quote of the string,
causing subsequent SQL tokens to be interpreted as part of the string literal.
Consequently,
an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality,
Integrity,
and Availability (
C:H/I:H/A:H
).
It requires low attack complexity (
AC:L
),
no privileges (
PR:N
),
and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.
2.
0 up to (excluding) 8.
2.
31
PHP 8.3.*:
From 8.
3.
0 up to (excluding) 8.
3.
31
PHP 8.4.*:
From 8.
4.
0 up to (excluding) 8.
4.
21
PHP 8.5.*:
From 8.
5.
0 up to (excluding) 8.
5.
6
References & Advisory Links
References & Advisory Links
Ask Gemini
Ask Gemini
Upload & tools
Stop response
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77680
|
|
77681
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89:
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction.
When copying a string token containing a
NUL
byte,
the driver utilizes
strncat()
,
which terminates prematurely at the
NUL
byte.
This drops the closing quote of the string,
causing subsequent SQL tokens to be interpreted as part of the string literal.
Consequently,
an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality,
Integrity,
and Availability (
C:H/I:H/A:H
).
It requires low attack complexity (
AC:L
),
no privileges (
PR:N
),
and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.
2.
0 up to (excluding) 8.
2.
31
PHP 8.3.*:
From 8.
3.
0 up to (excluding) 8.
3.
31
PHP 8.4.*:
From 8.
4.
0 up to (excluding) 8.
4.
21
PHP 8.5.*:
From 8.
5.
0 up to (excluding) 8.
5.
6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
Ask Gemini
Ask Gemini
Upload & tools
Stop response
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77681
|
|
77682
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89:
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction.
When copying a string token containing a
NUL
byte,
the driver utilizes
strncat()
,
which terminates prematurely at the
NUL
byte.
This drops the closing quote of the string,
causing subsequent SQL tokens to be interpreted as part of the string literal.
Consequently,
an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality,
Integrity,
and Availability (
C:H/I:H/A:H
).
It requires low attack complexity (
AC:L
),
no privileges (
PR:N
),
and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.
2.
0 up to (excluding) 8.
2.
31
PHP 8.3.*:
From 8.
3.
0 up to (excluding) 8.
3.
31
PHP 8.4.*:
From 8.
4.
0 up to (excluding) 8.
4.
21
PHP 8.5.*:
From 8.
5.
0 up to (excluding) 8.
5.
6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
Ask Gemini
Ask Gemini
Upload & tools
Stop response
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77682
|
|
77683
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements....
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77683
|
|
77684
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77684
|
|
77685
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77685
|
|
77686
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77686
|
|
77687
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77687
|
|
77688
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Redo
Share & export
Copy
Show more options
how to fi
how to fi
Upload & tools
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77688
|
|
77689
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Redo
Share & export
Copy
Show more options
how to fi
how to fi
Upload & tools
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77689
|
|
77690
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Redo
Share & export
Copy
Show more options
how to fix
how to fix
Upload & tools
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77690
|
|
77691
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Edit
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Redo
Share & export
Copy
Show more options
how to fix
how to fix
Upload & tools
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77691
|
|
77692
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Ask Gemini
Ask Gemini
Upload & tools
Stop response
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Gemini is typing
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77692
|
|
77693
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Ask Gemini
Ask Gemini
Upload & tools
Stop response
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Gemini is typing
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)
8.2.31
Up to (excluding)
8.3.31
Up to (excluding)
8.4.21
Up to (excluding)
8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know
Are we missing a CPE here? Please let us know
.
Change History
Change History
2 change records found
show changes
show changes
QUICK INFO
QUICK INFO
CVE Dictionary Entry:
CVE-2025-14179
CVE-2025-14179
NVD Published Date:
05/10/2026
NVD Last Modified:
05/12/2026
Source:
PHP Group...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77693
|
|
77694
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
Ask Gemini
Ask Gemini
Upload & tools
Stop response
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Gemini replied
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
Up to (excluding)
8.2.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.3.0
Up to (excluding)
8.3.31
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.4.0
Up to (excluding)
8.4.21
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.5.0
Up to (excluding)
8.5.6
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
From (including)
8.2.0
From (including)
8.3.0
From (including)
8.4.0
From (including)
8.5.0
Up to (excluding)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77694
|
|
77697
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability,
you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version.
The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases.
Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
Ask Gemini
Ask Gemini
Upload & tools
Stop response
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)
...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77697
|
|
77701
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77701
|
|
77704
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77704
|
|
77718
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77718
|
|
77719
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
rircroxhsttonooononsrnnel:v Gooc e GeminiGemini 3.1 Pro ~(JY-19958) Upgrade BE Ibrariesjiminnylapo/backend-code - Vant* NVD - cve-2028-61041 NVD - Cve-2026-67224, NVD -Cv-2026-72611% NVD - CVe-2025-14179( Hich vulnerabilities identified inMediam wloeat hes dees thech0 Low vuinerabilities identified in pY-20613) Allow awner's role toText relayA TypeError: Jiminmy/Services|MainaCloudwntch lusrenstdG 1y-20915 (re strict Coltina bu t( JY-20963 fic deleted object impor© Lukas Kovalik - Time OffTypeError: Aminey(Services/MaiNTNew Tab+ New Tatcombination of software upgrades and secure coding practices.Here are the recommended steps to resolve the issue:1. Upgrade PHP (Primary Fix)The most direct and complete fix is to update your PHP environment to a patched version. The PHPgroup has addressed the flawed strncat() handling of NUL bytes in the following releases.Upgrade to at least:PHP 8.2: Upgrade to 8.2.31 or later.PHP 8.3: Upgrade to 8.3.31 or later.PHP 8.4: Upgrade to 8.4.21 or later.PHP 8.5: Upgrade to 8.5.6 or later.2. Implement Code-Level MitigationsIf you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjustyour database interaction code:Use Prepared Statements: Stop using PD0: : quote() to manually escape user input andconcatenate strings into SQL queries. Instead, use PDO prepared statements withparameterized queries. Parameterized queries send the data separately from the SQLcommand structure, rendering this specific vulnerability (and most other SQL injection vectors)ineffective.Input Sanitization and Validation: Actively reject or strip NUL bytes ( \0 ) from user-supplieddata before it ever reaches your database logic. You can use PHP functions likesty reolace?""Sinout) to sanitize the data, thouch parameterized queriesremain the stronger security control.Review Firebird Usage: If you do not actively use the Firebird database, disable the PDOFrenird extension in vour nan.ins conticuration to reduce vour attack surtaceAsk GeminiYor lim now chate thn" uend to imntoy our modale Camioie Alit cao mata mttrkae co donbld chachit Yoir mracy & CaminiSummarize pageNSInformatiorNATIONVULNERABILJECVEDescriInPhr versNUL byteswstrncatO, whThis allows:MetriNVD enricheCVSS 3.RefereBy selectinginformationpage. Thereor concurwthese sites.URLWeaknaur tnDXP4800PLUS-B5F8Garmin Dashboarde New Tab+ New TabNot Secure http://[IP_ADDRESS]:8007/ui% Garmin DashboardAvo sueth6h 14mBEST SLEEP8h 21mn sieco Duration2,0982026-05-252026-05-242026-05-232026-05-222026-05.22026-05-202026-05-192026-05-182076-05-72026.05.162026-05-152026-05-142026-05-132026-05-12SOAR ARA02026-05-092026-05-08DURATION5h 21m8h 21m5h 15m5h 13m6h 12m5h 4m6h 42m6h 17m7n50m5h1ml4h 39m6h 45m5h 44m6h 1m7h 45m6h 44m6h 33mARATIM2026-05-24 21:242026-05-23 20:302026-05-22 21:472026-05-21 21:492026-05 20 20782026-05-19 22:182026-05-18 20:282026-05-17 19:592026-05-16 20:152026-05.15 21:50MOARARDtSMANEASNOA2026-05-12 20:532026-05-11 20:36MANEARN0 402026-05-08 21:312026-05-07 20:565,925$0100% K/A•Wed 27 May 14:12:0127/ 84/2826ANGPEGTING HE66 bpm27 / 05 / 2026 €HP PANGI43-126WAKE202k.A6.2502.2026-05-24 05:292026-05-23 03:292026-05-22 03:312026-05-21.03-062026-05-20 04:002026-05-19 03:362026-05-18 03:392026-05-17 04:502026-05-16.08:2026-05-15 04:032026-05-14 03:432026-05-13 03:382026-05-12 03-37MaykehhahlokeOANGAR10OR4T2026-05-09 04:312026-05-08 03:46QUALITYGoodShortShorFalrShortFairFairGoodShortShortFairFairFairGoodFairFair...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77719
|
|
77720
|
Platform Sprint 5 Q2 - Platform Team - Scrum Board Platform Sprint 5 Q2 - Platform Team - Scrum Board - Jira
[JY-20915] Add environment-specific email domains for text relay to prevent duplicate processing - Jira
Unnamed Group
[JY-19958] Upgrade BE libraries - May - Jira
[JY-19958] Upgrade BE libraries - May - Jira
jiminny/app/backend-code - Vanta
jiminny/app/backend-code - Vanta
NVD - cve-2026-6104
NVD - cve-2026-6104
NVD - cve-2026-6722
NVD - cve-2026-6722
NVD - cve-2026-7261
NVD - cve-2026-7261
NVD - cve-2025-14179
NVD - cve-2025-14179
Close tab
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
High vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Medium vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
Low vulnerabilities identified in packages are addressed (GitHub Repo) - Vanta
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Text relay
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
CloudWatch | us-east-2
CloudWatch | us-east-2
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20915 fix strict casting by LakyLak · Pull Request #12134 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Jiminny
Jiminny
Audi Motors | Account | Salesforce
Audi Motors | Account | Salesforce
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
TypeError: Jiminny\Services\Mail\TextRelayService::setHistoryPoint(): Argument #2 ($historyPoint) must be of type int, string given, called in /home/jiminny/app/Services/Mail/TextRelayService.php on line 118 — jiminny — app
New Tab
New Tab
New Tab
Customize sidebar
Close Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
AI Chat settings
Close
Main menu
Open mode picker, currently 3.1 Pro
Gemini
3.1 Pro
New Chat
Open menu for conversation actions.
Conversation with Gemini
Conversation with Gemini
You said I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements. Metrics NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed. CVSS 3.x Severity and Vector Strings: NIST: NVD Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H References to Advisories, Solutions, and Tools By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [EMAIL]. URL Source(s) Tag(s) https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm PHP Group Vendor Advisory Weakness Enumeration CWE-ID CWE Name Source CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') PHP Group Known Affected Software Configurations Switch to CPE 2.2 Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s) From (including)8.5.0Up to (excluding)8.5.6 Denotes Vulnerable Software Are we missing a CPE here? Please let us know. Change History 2 change records found show changes</selection>” selected. Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
You said
I’m on page “<tabTitle>NVD - cve-2025-14179</tabTitle>” with “<selection>Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 3.x Severity and Vector Strings:
NIST: NVD
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [EMAIL].
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
Known Affected Software Configurations Switch
to CPE 2.2
Configuration 1 ( hide ) cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.2.0Up to (excluding)8.2.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.3.0Up to (excluding)8.3.31 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.4.0Up to (excluding)8.4.21 cpe:2.3:a:php:php:*:*:*:*:*:*:*:* Show Matching CPE(s)
From (including)8.5.0Up to (excluding)8.5.6
Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.
Change History
2 change records found show changes</selection>” selected.
Please summarize the selection using precise and concise language. Use headers and bulleted lists in the summary, to make it scannable. Maintain the meaning and factual accuracy.
Expand
Copy prompt
Gemini said
Gemini said
Vulnerability Summary
Vulnerability Summary
CVE Identifier:
CVE-2025-14179
Vulnerability Type:
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Component:
PHP PDO Firebird driver
Technical Description
Technical Description
The PDO Firebird driver improperly handles
NUL
bytes during token-by-token SQL query construction. When copying a string token containing a
NUL
byte, the driver utilizes
strncat()
, which terminates prematurely at the
NUL
byte. This drops the closing quote of the string, causing subsequent SQL tokens to be interpreted as part of the string literal. Consequently, an attacker can achieve SQL injection if user-controlled values are processed via
PDO::quote()
and embedded into SQL statements.
Severity and Impact
Severity and Impact
CVSS 3.1 Score / Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Profile:
High impact across Confidentiality, Integrity, and Availability (
C:H/I:H/A:H
). It requires low attack complexity (
AC:L
), no privileges (
PR:N
), and no user interaction (
UI:N
).
Affected Software Configurations
Affected Software Configurations
The vulnerability affects the following PHP versions:
PHP 8.2.*:
From 8.2.0 up to (excluding) 8.2.31
PHP 8.3.*:
From 8.3.0 up to (excluding) 8.3.31
PHP 8.4.*:
From 8.4.0 up to (excluding) 8.4.21
PHP 8.5.*:
From 8.5.0 up to (excluding) 8.5.6
References & Advisory Links
References & Advisory Links
Vendor Advisory:
GitHub Security Advisory (GHSA-w476-322c-wpvm)
GitHub Security Advisory (GHSA-w476-322c-wpvm)
provided by the PHP Group.
Good response
Bad response
Share & export
Copy
Show more options
You said how to fix
You said
how to fix
Copy prompt
Edit
Gemini said
Gemini said
To fix or mitigate the
CVE-2025-14179
SQL injection vulnerability, you should implement a combination of software upgrades and secure coding practices.
Here are the recommended steps to resolve the issue:
1. Upgrade PHP (Primary Fix)
1. Upgrade PHP (Primary Fix)
The most direct and complete fix is to update your PHP environment to a patched version. The PHP group has addressed the flawed
strncat()
handling of
NUL
bytes in the following releases. Upgrade to at least:
PHP 8.2:
Upgrade to
8.2.31
or later.
PHP 8.3:
Upgrade to
8.3.31
or later.
PHP 8.4:
Upgrade to
8.4.21
or later.
PHP 8.5:
Upgrade to
8.5.6
or later.
2. Implement Code-Level Mitigations
2. Implement Code-Level Mitigations
If you cannot immediately upgrade your PHP environment, or as a defense-in-depth measure, adjust your database interaction code:
Use Prepared Statements:
Stop using
PDO::quote()
to manually escape user input and concatenate strings into SQL queries. Instead, use PDO prepared statements with parameterized queries. Parameterized queries send the data separately from the SQL command structure, rendering this specific vulnerability (and most other SQL injection vectors) ineffective.
Input Sanitization and Validation:
Actively reject or strip
NUL
bytes (
\0
) from user-supplied data before it ever reaches your database logic. You can use PHP functions like
str_replace("\0", "", $input)
to sanitize the data, though parameterized queries remain the stronger security control.
Review Firebird Usage:
If you do not actively use the Firebird database, disable the PDO Firebird extension in your
php.ini
configuration to reduce your attack surface.
Good response
Bad response
Redo
Share & export
Copy
Show more options
Ask Gemini
Ask Gemini
Upload & tools
Microphone
Send message
Your Jiminny chats aren’t used to improve our models. Gemini is AI. It can make mistakes, so double check it.
Your privacy & Gemini Opens in a new window
Your privacy & Gemini
Opens in a new window
Summarize page
Summarize page
An official website of the United States government
Here's how you know
Here's how you know
National Institute of Standards and Technology
NVD MENU
NVD
MENU
Information Technology Laboratory
Information Technology Laboratory
Information Technology Laboratory
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
NATIONAL VULNERABILITY DATABASE
VULNERABILITIES
VULNERABILITIES
CVE-2025-14179 Detail
CVE-2025-14179
Detail
Description
Description
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Metrics
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:
NIST:
NVD
Base Score:
9.8 CRITICAL
9.8 CRITICAL
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References to Advisories, Solutions, and Tools
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to
[EMAIL]
[EMAIL]
.
URL
Source(s)
Tag(s)
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
PHP Group
Vendor Advisory
URL
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
https://github.com/php/php-src/security/advisories/GHSA-w476-322c-wpvm
Source(s)
PHP Group
Tag(s)
Vendor Advisory
Weakness Enumeration
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-89
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
PHP Group
CWE-ID
CWE-89
CWE-89
CWE Name
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Source
PHP Group
Known Affected Software Configurations Switch to CPE 2.2
Known Affected Software Configurations
Switch to CPE 2.2
Switch to CPE 2.2
Configuration 1
(
hide
hide
)
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
Show Matching CPE(s)
Show Matching CPE(s)...
|
Firefox
|
NVD - cve-2025-14179 — Work
|
nvd.nist.gov/vuln/detail/cve-2025-14179
|
77720
|
|
57733
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Project Phoenix – Figma
Project Phoenix – Figma
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
Pipelines - jiminny/app
Pipelines - jiminny/app
New Tab
New Tab
Jiminny
Jiminny
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
Jiminny
Jiminny
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
JY-20676-delete-report-related-objects ■ 889458...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/ondemand?page=1
|
57733
|
|
57734
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Project Phoenix – Figma
Project Phoenix – Figma
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
Pipelines - jiminny/app
Pipelines - jiminny/app
New Tab
New Tab
Jiminny
Jiminny
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/ondemand
|
57734
|
|
57735
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Project Phoenix – Figma
Project Phoenix – Figma
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
Pipelines - jiminny/app
Pipelines - jiminny/app
New Tab
New Tab
Jiminny
Jiminny
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
Jiminny
Jiminny
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
JY-20676-delete-report-related-objects ■ 889458
99+
99+
27
activities
Get Notified
Sort by Sort by: Most recent
Sort by
Sort by:
Most recent
Add Recording
common.ai-icon-alt
Team:
Engineering
Duration:
1m and above
Recorded:
Only Recorded
Save Search
Clear all
Saved searches Saved searches
Saved searches
Saved searches
Team
Engineering × Search teams
Engineering
×
Search teams
Host
Search team members Search team members
Search team members
Search team members
Also search as participant
Participant
Search team members Search team members
Search team members
Search team members
Customer
Customer
Transcript
Search transcript
Select option Said by
Select option
Said by
Select option Anyone
Select option
Anyone
Period
All time
Topics
Search topics Search topics
Search topics
Search topics
Activity type
Search activity types Search activity types
Search activity types
Search activity types
Duration
Min (minutes)...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/ondemand
|
57735
|
|
57736
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Project Phoenix – Figma
Project Phoenix – Figma
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
Pipelines - jiminny/app
Pipelines - jiminny/app
New Tab
New Tab
Jiminny
Jiminny
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
Jiminny
Jiminny
Close tab
New Tab
Customize sidebar...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/ondemand
|
57736
|
|
58551
|
SlackFileEditViewGoHistoryWindowHelp•APPDOCKER• ₴1 SlackFileEditViewGoHistoryWindowHelp•APPDOCKER• ₴1DEV (docker)₴82APP (-zslCounting objects: 100% (2/2), done.Compressing objects: 100% (2/2),remote: Total 2 (delta 0),reused 0 (delta 0), pack-reusedUnpacking objects: 100% (2/2), 2.59 KiB | 1.29 MiB/s, done.1.2 packs, used 0 (from o)From github.com:jiminny/app478e5b33d8..6ecd5a5ff7JY-20676-delete-report-related-objects ->origin/JY-20676-dele*Merge made by theroutes/api.php 17++++---1 file changed, 4 insertions(+),3 deletions(-)lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/jiminny/app (JY-20676-delete-report-related-obOn branch JY-20676-delete-report-related-objectsYour branch isahead of 'origin/JY-20676-delete-report-related-objects' by 2 commits.Cuse"git push"to publish your local commits)Changes notstaged for commit:(use"git add<file>..."to update what will becommitted)Cuse "git restore ‹file›..."to discard changesin working directory)modified:env.localmodified:app/Console/Commands/JiminnyDebugCommand.phpmodified:config/logging.phpUntracked files:Cuse "git add<file>..." to include in what will be committed)env.nikilocal.env.otherWEBHOOK_FILTERING_IMPLEMENTATION.mdapp/Console/Commands/Crm/Hubspot/SimulateWebhooksCommand.phpapp/Console/Commands/Reports/CreateMockAskJiminnyReportResultCommand.phpids.txtpublic/favicon.icoraw_sql_query.sqltests/Unit/Policies/CanAccessAiReportsTest.phpchanges added to commit (use "gitadd" and/or "git commit -a")lukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/jiminny/app (JY-20676-delete-report-related-obEnumerating objects: 24, done.Counting objects: 100% (18/18), done.Deltacompression using up to 8 threadsCompressing objects: 100% (9/9), done.Totin1o baects: 7, % s/10 ((e.e1 K), pack-rause/s, done.remote: Resolving deltas: 100% (7/7), completed with 6 local objects.To github.com:jiminny/app.git6ecd5a5ff7..56ca84fabdJY-20676-delete-report-related-objects -> JY-20676-delete-reporlukas@Lukas-Kovaliks-MacBook-Pro-Jiminny ~/jiminny/app (JY-20676-delete-report-related-obHomeDMsActivityFilesLater..•MoreED→Jiminny ...# general# jiminny-bg# platform-tickets# product_launches# random# releases# sofia-office# support# thank-yous# the_people_of _jimi...• Direct messagesRo Nikolay YankovD. Galya Dimitrova Me. Vasil Vasilev®. Aneliya Angelova8. Stefka Stoyanova. Stoyan TomovBs Todor Stamatov *Mario Georgiev. Nikolay Ivanovdo James Graham8 Stoyan TanevE Lukas Kovalik y... 0::: Apps|i Jira CloudToastall100% <73• Tue 19 May 15:52:44Describe what you are looking for# releases8 226 0• MessagesC Files• Bookmarks+177ea29b- Mequest #12102 fromTodayjiminny/JY-209~e un ur ai-call-scoring-accessjiminny/app| Added by GitHubCircleCI APP 3:00 PMDeployment Successful!Project: appWhen:05/19/202612:00:02Tag:View JobNewCircleCl APP3:35 PMNew commits deployed to Prophet Prod-US:[b1b41a2)(https://github.com/jiminny/prophet/commit/b1b41a207d8271f8f3128b3633b9b70597151ea2) -[JY-20919](https://jiminny.atlassian.net/browse/JY-20919): Lower exec reports batch size #518)(steliyan-g)New commits deployed to Prophet Prod-EU:[b1b41a2)(https://github.com/jiminny/prophet/commit/b1b41a207d8271f8f3128b3633b9b70597151ea2)-[JY-20919](https://jiminny.atlassian.net/browse/JY-20919): Lower exec reports batch size (#518)(steliyan-g)Message #releases+Aa......
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/ondemand
|
58551
|
|
58552
|
rireroxcalVIewHistoryPlatform Sprint 4 02 - Platfo rireroxcalVIewHistoryPlatform Sprint 4 02 - PlatformService-Desk - Queues - PlatforiSRD-6848) Sidekick SMS issue() JY-20725 add HS rate limit handlinJY-20808 low priority indexing qu) New Tab8 JiminnySevenShores|Hubspot\Exceptil9 JliminnyJY-20676 delete AJ reports rel XJ New TahExolore08SettinasbookmarksProtlles1OOISWindowmelplinny.sentry.io/issues/7007366572/?environment=production-eu&environment=production&project=82419&Issues / le APP-1EEDsevenshores \Hubspot\Exceptions \Badkequest•Client error: POST [URL_WITH_CREDENTIALS] resulted in a429 Too Many Requests' response"correlationId":"019e3d8c-d (truncated...)generinGrached in non-ann:/vendor/hubcnot/hubsnot-nhn/crc/Gycentions/HubsnotEycention.nhn.04in SovenShoreel Hubsnot|Gycentionel HuhenotFycentionucroat//app/Services/Crm/Hubspot/Pagination/HubspotPaginationService.php:163 in Jiminny\Services\Crm\Hubspot\Pagination\HubspotPaginationService::executeSearchRequest159private function executeSearchRequest(Client Sclient, string Sendpoint, array Spayload. PaginationState Sstate): array161try163Sresponse = Sclient->getInstance()->getClient()->request('POST', Sendpoint, ['json' => Spayload]):roturn Grocnonco-stoArraul)catch (NFycention Celfif (Sclient->isllnauthorizedFycention/Se))Sthis->logger->warning('[Hubspot] Got 401 during pagination, attempting token refresh'. [Apr 30 9:00 PMTrace: Trace 1D0 69% 874509os.buildView all tagsStack TraceJump to: Hignlignts© Copy as v25286542/d/8451/Ye93D8//rdbocyad# Display vCopy as vShow 1 more frame100% Lz• lue 19 May 10:02.44@ Ask Seer &.Events (totalUsers (90d)17KPriority ailvAssignee LK Lukas KovalikLast seen 13 hours agoin release 888800First seen 6 months agov Seer Autofix €Meet Seer, your Al assistantDebug faster with Sentry's agent,Seer. Seer connects to vour reoos.scans your issues, hiahliahts quickfixes, and proposes solutions. You caneven integrate with your favoriteadent to imolement chandes in code.[ Try out Seer now• Issue Trackinge GitHubS Jiralv Activitv• Assianed3 months aad• Marked as Ongoingo months agoautomaticallv bv SentrvFirst Seeno months agoMarked as high priorityv PeopleLK participating(SSIK MPIN viewedcimilar IssuesViewMeraed IssuesView...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/ondemand
|
58552
|
|
58553
|
Unnamed Group
Platform Sprint 4 Q2 - Platform Team Unnamed Group
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
New Tab
New Tab
Jiminny
Jiminny
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Jiminny
Jiminny
Close tab
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
JY-20676-delete-report-related-objects ■ 889458
99+
99+
27
activities
Get Notified
Sort by Sort by: Most recent
Sort by
Sort by:
Most recent
Add Recording
common.ai-icon-alt
Team:
Engineering
Duration:...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/ondemand
|
58553
|
|
58554
|
Unnamed Group
Platform Sprint 4 Q2 - Platform Team Unnamed Group
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
[SRD-6848] Sidekick SMS issue - Jira
[SRD-6848] Sidekick SMS issue - Jira
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
New Tab
New Tab
Jiminny
Jiminny
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Jiminny
Jiminny
Close tab
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
JY-20676-delete-report-related-objects ■ 889458
99+
99+
27
activities
Get Notified
Sort by Sort by: Most recent
Sort by
Sort by:
Most recent
Add Recording...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/ondemand
|
58554
|
|
57710
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Project Phoenix – Figma
Project Phoenix – Figma
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
Pipelines - jiminny/app
Pipelines - jiminny/app
New Tab
New Tab
Jiminny
Jiminny
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
Issues - app in Jiminny SonarQube Cloud
Issues - app in Jiminny SonarQube Cloud
Jiminny
Jiminny
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Waiting for neptune.staging.jiminny.com…...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/login
|
57710
|
|
57711
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Project Phoenix – Figma
Project Phoenix – Figma
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
Pipelines - jiminny/app
Pipelines - jiminny/app
New Tab
New Tab
Jiminny
Jiminny
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
Issues - app in Jiminny SonarQube Cloud
Issues - app in Jiminny SonarQube Cloud
Jiminny
Jiminny
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
Sign In
Sign In
google Sign in with Google
Sign in with Google
microsoft Sign in with Office 365
Sign in with Office 365
Login via SSO
Login via SSO
EU
EU
Worldwide
JY-20676-delete-report-related-objects ■ 889458
Don’t have account yet? Speak to your sales leader to get an invite.
By using this service you agree to the
Privacy Policy
Privacy Policy
and
Terms of Service
Terms of Service
.
TERMS
TERMS
KNOWLEDGE BASE
KNOWLEDGE BASE
BLOG
BLOG
neptune.staging.jiminny.com/auth/redirect/google?redirectUrl=...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/login
|
57711
|
|
57712
|
Platform Sprint 4 Q2 - Platform Team - Scrum Board Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Platform Sprint 4 Q2 - Platform Team - Scrum Board - Jira
Project Phoenix – Figma
Project Phoenix – Figma
Service-Desk - Queues - Platform team - Service space - Jira
Service-Desk - Queues - Platform team - Service space - Jira
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20725 add HS rate limit handling on activities rematching by LakyLak · Pull Request #12066 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
JY-20808 low priority indexing queue by Vasil-Jiminny · Pull Request #12082 · jiminny/app
Pipelines - jiminny/app
Pipelines - jiminny/app
New Tab
New Tab
Jiminny
Jiminny
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
JY-20676 delete AJ reports related objects by LakyLak · Pull Request #12098 · jiminny/app
Issues - app in Jiminny SonarQube Cloud...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/login
|
57712
|
|
75391
|
Platform Team - Backlog - Jira
Service-Desk - Queu Platform Team - Backlog - Jira
Service-Desk - Queues - Platform team - Service space - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Feed — jiminny — Sentry
Feed — jiminny — Sentry
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Inbox (1,727) - [EMAIL] - Jiminny Mail
Inbox (1,727) - [EMAIL] - Jiminny Mail
New Tab
New Tab
CloudWatch | us-east-2
CloudWatch | us-east-2
Jiminny
Jiminny
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
JY-20676-delete-report-related-objects ■ 891718
99+
99+
Kiosk
Organizations
Organizations
Setup Account
Setup Account
Users
Users
Activities
Activities
Automated Reports
Automated Reports
Mobile version
Mobile version
Search
NAME
SFDC ACCOUNT
Open Intercom Messenger...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/kiosk/onboard-list
|
75391
|
|
75392
|
Platform Team - Backlog - Jira
Service-Desk - Queu Platform Team - Backlog - Jira
Service-Desk - Queues - Platform team - Service space - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Feed — jiminny — Sentry
Feed — jiminny — Sentry
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Inbox (1,727) - [EMAIL] - Jiminny Mail
Inbox (1,727) - [EMAIL] - Jiminny Mail
New Tab
New Tab
CloudWatch | us-east-2
CloudWatch | us-east-2
Jiminny
Jiminny
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
JY-20676-delete-report-related-objects ■ 891718
99+
99+
Kiosk
Organizations
Organizations
Setup Account
Setup Account
Users
Users
Activities
Activities
Automated Reports
Automated Reports
Mobile version
Mobile version
Search
NAME
SFDC ACCOUNT
No accounts found
Server Error
Close notification
Open Intercom Messenger...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/kiosk/onboard-list
|
75392
|
|
75393
|
Platform Team - Backlog - Jira
Service-Desk - Queu Platform Team - Backlog - Jira
Service-Desk - Queues - Platform team - Service space - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Feed — jiminny — Sentry
Feed — jiminny — Sentry
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Inbox (1,727) - [EMAIL] - Jiminny Mail
Inbox (1,727) - [EMAIL] - Jiminny Mail
New Tab
New Tab
CloudWatch | us-east-2
CloudWatch | us-east-2
Jiminny
Jiminny
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
JY-20676-delete-report-related-objects ■ 891718
99+
99+
Kiosk
Organizations
Organizations
Setup Account
Setup Account
Users
Users
Activities
Activities
Automated Reports
Automated Reports
Mobile version
Mobile version
Search
NAME
SFDC ACCOUNT
No accounts found
Open Intercom Messenger
Clear
Filter URLs
Pause/Resume recording network log
New Request
Search
Request Blocking
All
HTML
CSS
JS
XHR
Fonts
Images
Media
WS
Other
Disable Cache
Disable Cache
No Throttling
Network Settings
• Perform a request or
Reload
the page to see detailed information about network activity.
• Click on the
Analyze
button to start performance analysis.
Learn more about performance analysis
Start performance analysis
No requests...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/kiosk/onboard-list
|
75393
|
|
75394
|
Platform Team - Backlog - Jira
Service-Desk - Queu Platform Team - Backlog - Jira
Service-Desk - Queues - Platform team - Service space - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Feed — jiminny — Sentry
Feed — jiminny — Sentry
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
JY-20963 fix deleted object import by LakyLak · Pull Request #12121 · jiminny/app
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
SevenShores\Hubspot\Exceptions\BadRequest: Client error: `POST https://api.hubapi.com/crm/v3/objects/contact/search` resulted in a `429 Too Many Requests` response: {"status":"error","message":"You have reached your secondly limit.","errorType":"RATE_LIMIT
Lukas Kovalik - Time Off
Lukas Kovalik - Time Off
Inbox (1,727) - [EMAIL] - Jiminny Mail
Inbox (1,727) - [EMAIL] - Jiminny Mail
New Tab
New Tab
CloudWatch | us-east-2
CloudWatch | us-east-2
Jiminny
Jiminny
Close tab
New Tab
Customize sidebar
Open Google Gemini (⌃X)
Tabs from other devices
Open history (⇧⌘H)
Open bookmarks (⌘B)
JY-20676-delete-report-related-objects ■ 891718
99+
99+
Kiosk
Organizations
Organizations
Setup Account
Setup Account
Users
Users
Activities
Activities
Automated Reports
Automated Reports
Mobile version
Mobile version
Search
NAME
SFDC ACCOUNT
No accounts found
Open Intercom Messenger
Clear
Filter URLs
Pause/Resume recording network log
New Request
Search
Request Blocking
All
HTML
CSS
JS
XHR
Fonts
Images
Media
WS
Other
Disable Cache
Disable Cache
No Throttling
Network Settings
Status
Status
Method
Method
Domain
Domain
File
File
Initiator
Initiator
Type
Type
Transferred
Transferred
Size
Size
0 ms
0 ms
200
POST
r.logr-in.com
i?a=ponxaf/platform-staging&r=6-019e6886-cae3-7e11-a0c4-e0fdaafb5c83&t=1f17876a-b55e-4330-9100-130efaa5c6be&s=0&hr=t&u=283a2d9a-952a-43dc-b9fb-cfc45409971e&is=IDENTIFIED&rs=0,t
xhr
json
2.97 kB
0 B
210 ms
Status
Status
200
Method
Method
POST
Domain
Domain
r.logr-in.com
File
File
i?a=ponxaf/platform-staging&r=6-019e6886-cae3-7e11-a0c4-e0fdaafb5c83&t=1f17876a-b55e-4330-9100-130efaa5c6be&s=0&hr=t&u=283a2d9a-952a-43dc-b9fb-cfc45409971e&is=IDENTIFIED&rs=0,t
Initiator
Initiator
xhr
Type
Type
json
Transferred
Transferred
2.97 kB
Size
Size
0 B
0 ms
0 ms
210 ms
Start performance analysis
1 request
0 B / 2.97 kB transferred
Finish: 214 ms...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/kiosk/onboard-list
|
75394
|
|
75395
|
Platform Team - Backlog - Jira
Service-Desk - Queu Platform Team - Backlog - Jira
Service-Desk - Queues - Platform team - Service space - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
[JY-20613] Allow owner's role to be selected when setting up a trial - Jira
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app
Allow owner's role to be selected when setting up a trial by LakyLak · Pull Request #12092 · jiminny/app...
|
Firefox
|
Jiminny — Work
|
neptune.staging.jiminny.com/kiosk/onboard-list
|
75395
|