CVE-2025-8264
1 advisory.
Packagist/z-push/z-push-dev CVE-2025-8264: critical 9
z-push/z-push-dev SQL Injection Vulnerability
Action: Upgrade z-push/z-push-dev to 2.7.6 or later.
composer require z-push/z-push-dev:2.7.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.6 | - |
Fixed versions
| 2.7.6 |
Sources
- osv: GHSA-w832-w3p8-cw29
- https://nvd.nist.gov/vuln/detail/CVE-2025-8264
- https://github.com/Z-Hub/Z-Push/pull/161
- https://github.com/Z-Hub/Z-Push/pull/161/commits/f981d515a35ac4c303959af21dce880a5db02786
- https://github.com/Z-Hub/Z-Push/commit/deb044a40e97dab1814da9aa8330c0a590957fc5
- https://github.com/Z-Hub/Z-Push
- https://github.com/Z-Hub/Z-Push/blob/af25a2169a50d6e05a5916d1e8b2b6cd17011c98/src/backend/imap/user_identity.php%23L211C9-L214C25
- https://security.snyk.io/vuln/SNYK-PHP-ZPUSHZPUSHDEV-10908180
- https://xbow.com/blog/xbow-zpush-sqli
CVE-2025-8264 · published · modified · JSON