CVE-2026-42475

The MixPHP Framework (versions 2.x through 2.2.17 ) is vulnerable to an SQL injection vulnerability. The root cause is the improper manipulation of the on array parameter within the joinOn() function located in the BuildHelper.php file. An attacker can exploit this by providing a crafted on array...

CVE-2026-37552

CVE-2026-37552 . Affected: MixPHP Framework 2.x up to 2.2.17. Root cause: unsafe deserialization using Opis\Closure\unserialize() on data received by the sync-invoke TCP server, then executed via call_user_func(). No authentication/signature on the localhost TCP port (127.0.0.1). Impact: arbitrar...