CVE-2026-112307High· 7.3▾ Twilightsqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHP…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed ${expr} or {${expr}} sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP code when the generated snippet runs.
sqlparse <= 0.6.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-59894Mediumsqlparse is a non-validating SQL parser module for Python
GHSA-27jp-wm6q-gp25Mediumsqlparse: formatting list of tuples leads to denial of service
CVE-2026-84305Medium· 6.2sqlparse is a non-validating SQL parser module for Python
CVE-2026-54284High· 7.5sqlparse is a non-validating SQL parser module for Python
CVE-2026-59893High· 7.5sqlparse is a non-validating SQL parser module for Python
CVE-2021-32839High· 7.5StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)