The vulnerability is a classic SQL injection (CWE-89) that occurs when the category deletion endpoint accepts a category ID without proper sanitization. An attacker who can reach the category manager interface can inject arbitrary SQL through the ID field, potentially reading, modifying, or deleting data in the underlying database. This could expose sensitive data, alter business logic, or disrupt service.

The issue is present in all releases of PEAR’s pearweb component before version 1.33.0. Peart is a framework that ships PHP components. The only affected product is pearweb; no explicit list of operating systems is given, so the vulnerability exists wherever the vulnerable pearweb application is deployed as long as the attacker can access the category manager.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is less than 1 %, suggesting that exploit attempts are rare at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to authenticate or otherwise gain access to the category manager workflow, making the attack vector more local. Based on the description, it is inferred that local access is required because the vulnerability is tied to category manager workflow rather than exposed publicly. If those conditions are met, the attacker can inject SQL statements to manipulate database contents.