{"resultsPerPage":2,"startIndex":0,"totalResults":2,"format":"NVD_CVE","version":"2.0","timestamp":"2026-11-12T12:24:35.878","vulnerabilities":[{"cve":{"id":"CVE-2022-31631","sourceIdentifier":"security@php.net","published":"2025-02-12T22:15:29.007","lastModified":"2026-06-17T04:45:50.960","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities."},{"lang":"es","value":"En las versiones de PHP 8.0.* anteriores a 8.0.27, 8.1.* anteriores a 8.1.15, 8.2.* anteriores a 8.2.2, cuando se usa la función PDO::quote() para citar datos proporcionados por el usuario para SQLite, proporcionar una cadena demasiado larga puede provocar que el controlador cite incorrectamente los datos, lo que puede generar vulnerabilidades de inyección SQL."}],"affected":[{"source":"security@php.net","affectedData":[{"vendor":"PHP Group","product":"PHP","defaultStatus":"affected","packageName":"pdo_sqlite","versions":[{"version":"8.0.x","lessThan":"8.0.27","versionType":"semver","status":"affected"},{"version":"8.1.x","lessThan":"8.1.15","versionType":"semver","status":"affected"},{"version":"8.2.x","lessThan":"8.2.2","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@php.net","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-13T16:06:19.759677Z","id":"CVE-2022-31631","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@php.net","type":"Secondary","description":[{"lang":"en","value":"CWE-74"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.0.27","matchCriteriaId":"B25DE957-1D86-408D-AD1E-DBFB14115959"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.1.0","versionEndExcluding":"8.1.15","matchCriteriaId":"AF93F09C-C6A3-49AF-9202-0EC78065547D"},{"vulnerable":true,"criteria":"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.2","matchCriteriaId":"E87D2720-F21F-4FDE-A262-B8BA0B62AD98"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*","versionStartIncluding":"3.39.2","matchCriteriaId":"46D17F35-DB4A-491C-BB28-4BFA36F3618F"}]}]}],"references":[{"url":"https://bugs.php.net/bug.php?id=81740","source":"security@php.net","tags":["Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20230223-0007/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://bugs.php.net/bug.php?id=81740","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Vendor Advisory"]}]}},{"cve":{"id":"CVE-2026-119586","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-10-30T12:16:44.730","lastModified":"2026-11-03T15:29:16.870","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"SQLite","product":"SQLite","defaultStatus":"unaffected","collectionURL":"https://sqlite.org/","repo":"https://github.com/sqlite/sqlite","packageURL":"pkg:github/sqlite/sqlite","versions":[{"version":"0","lessThanOrEqual":"3.54.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.5,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-30T16:18:54.707240Z","id":"CVE-2026-119586","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-77"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*","versionEndIncluding":"3.54.1","matchCriteriaId":"8761120B-F740-4142-8A1B-7402F2023C9D"}]}]}],"references":[{"url":"https://abraxaslabs.tech/research/sqlite-cli-recover","source":"disclosure@vulncheck.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/sqlite/sqlite","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}}]}