CVE-2022-31631: PDO::quote() may return unquoted string

criticalCVSS 9.1CVE-2022-31631

CSIRTS triage

vendor: PHP product: PHP SQL injection

What: PDO::quote() may return an unquoted string, potentially leading to SQL injection.
Who is affected: PHP applications using PDO::quote() for query construction are affected.
Urgency: Critical severity with CVSS 9.1; this is a fundamental flaw in a security-critical function that can lead to SQL injection attacks.
Action: Update PHP to a patched version that correctly implements PDO::quote() and review all code relying on this function.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch PHP

Get an email when a new PHP advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: critical — CVSS 9.1
Published: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-31631

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2022-316312.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 81% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2022-31631	coverage & exploitation status	NVD · CVE.org

Recent advisories for PDO

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalCVE-2026-56705: Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, …nvd · 2026-08-25
unknownCVE-2026-58493: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, Database::__call bui…nvd · 2026-07-10
unknownCVE-2026-58492: grav-plugin-database is the database plugin for Grav CMS. Prior to 1.2.0, the PDO::tableExists…nvd · 2026-07-10