A security flaw tracked as CVE-2025-14179 has been found in specific versions of PHP, the common software that runs most dynamic websites. The affected versions are PHP 8.2 releases older than 8.2.31, 8.3 releases older than 8.3.31, 8.4 releases older than 8.4.21, and 8.5 releases older than 8.5.6.
The issue impacts the PHP tool used to connect to Firebird databases. When a quoted input containing a special invisible NUL character is added to a database query, the software fails to handle it correctly, dropping the closing quote for the input. This lets attackers slip unauthorized database commands into the query, a common vulnerability called SQL injection. If exploited, this could allow bad actors to access, change, or delete data stored in your website's database, including customer information, published content, or user account details.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2025-14179
