NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
CRITICAL severity

CVE-2014-125029 — pagination-service-provid…

CRITICALFix: ttskch/PaginationServiceProvider@619de47

CVE-2014-125029 is a critical-severity (CVSS 9.8) SQL Injection vulnerability in ttskch/pagination-service-provider. A fix is available for ttskch/pagination-service-provider — see the affected versions and patch details below.

PaginationServiceProvider SQL Injection vulnerability

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
0.9%probability of exploitation in next 30 days
Lower Risk+0.03%
Lower risk than most CVEs60th percentile — riskier than 60% of all scored CVEsHighest risk
0.06%0.51%0.95%1.39%0.6%0.9%May 26Aug 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐘ttskch/pagination-service-provider

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

A vulnerability was found in ttskch PaginationServiceProvider up to 0.x. It has been declared as critical. This vulnerability affects unknown code of the file demo/index.php of the component demo. The manipulation of the argument sort/id leads to sql injection. Upgrading to version 1.0.0 is able to address this issue. The patch is identified as 619de478efce17ece1a3b913ab16e40651e1ea7b. It is recommended to upgrade the affected component. VDB-217150 is the identifier assigned to this vulnerability.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistttskch/pagination-service-providerall versions1.0.0composer require ttskch/pagination-service-provider:^1.0.0

Affected Products

1 product · 1 configurations
Application
paginationserviceproviderpaginationserviceprovider_project
< 1.0.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for ttskch/pagination-service-provider, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update ttskch/pagination-service-provider to 1.0.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2014-125029 is resolved across your whole dependency graph.

  3. Workarounds

    Until you can upgrade, make sure every query built from user input uses parameterised statements or a prepared-statement API rather than string concatenation, and reduce the database account's privileges so an injected query cannot read or alter data beyond what the feature needs.

Frequently Asked Questions

A vulnerability was found in ttskch PaginationServiceProvider up to 0.x. It has been declared as critical. This vulnerability affects unknown code of the file `demo/index.php` of the component demo. The manipulation of the argument sort/id leads to sql injection. Upgrading to version 1.0.0 can address this issue. The name of the patch is 619de478efce17ece1a3b913ab16e40651e1ea7b. It is recommended to upgrade the affected component. VDB-217150 is the identifier assigned to this vulnerability.
O3 Security · Impact-Aware SCA

Is CVE-2014-125029 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2014-125029: pagination-service — Fixed in 1.0.0