CVE-2026-42475
MixPHP Framework has an SQL injection vulnerability
SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted on array to the joinOn function in BuildHelper.php.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted on array to the joinOn function in BuildHelper.php.
- Record
CVE-2026-42475- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2026-26676
SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted on array to the joinOn function in BuildHelper.php.
- Record
EUVD-2026-26676- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vf35-8m4j-gm8v
MixPHP Framework has an SQL injection vulnerability
SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted on array to the joinOn function in BuildHelper.php.
- Record
GHSA-vf35-8m4j-gm8v- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted on array to the joinOn function in BuildHelper.php.
- Record
CVE-2026-42475- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted on array to the joinOn function in BuildHelper.php.
- Record
CVE-2026-42475- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-vf35-8m4j-gm8v
MixPHP Framework has an SQL injection vulnerability
SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted on array to the joinOn function in BuildHelper.php.
- Record
GHSA-vf35-8m4j-gm8v- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mix/mixPackagist |
2.0.0 to 2.2.17 | None known |
mix/mixPackagist |
2.0.0 to 2.2.17, plus listed versions v2.0.1v2.0.1-Beta2v2.0.1-RCv2.0.1-RC2v2.0.1-RC5 Show 32 moreShow lessv2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.0.7v2.1.0v2.1.0-RCv2.1.0-RC2v2.1.0-betav2.1.1v2.1.10v2.1.11v2.1.12v2.1.15v2.1.3v2.1.4v2.1.5v2.1.6v2.1.7v2.1.9v2.2.11v2.2.12v2.2.13v2.2.14v2.2.15v2.2.16v2.2.17v2.2.4v2.2.5v2.2.7v2.2.9 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42475 is a medium vulnerability (CVSS 6.5) in Openmix Mix Php, published May 1, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. No source names a fixed version.
References
github.com/mix-php/mix
gist.github.com/sgInnora/fa46386840fe978a30d7e53c458f2975
nvd.nist.gov/vuln/detail/CVE-2026-42475