CVE-2022-31631: PHP

Critical severity, CVSS 9.1. EPSS: 2.2% chance of exploitation in the next 30 days.

In PHP versions 8.0.* before 8.0.27, 8.1.* before 8.1.15, 8.2.* before 8.2.2 when using PDO::quote() function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities.

Affected products

• PHP PHP: from 8.0.0, before 8.0.27 (fixed in 8.0.27); from 8.1.0, before 8.1.15 (fixed in 8.1.15); from 8.2.0, before 8.2.2 (fixed in 8.2.2)

Published 2025-02-12. Last modified 2026-06-17.