9.2
CVE-2026-77635
- EPSS 0.29%
- Veröffentlicht 24.08.2026 20:30:34
- Zuletzt bearbeitet 09.09.2026 21:06:39
- Erkennungen
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellercakephp
≫
Produkt
cakephp
Version
>= 5.1.0, < 5.1.10
Status
affected
Version
>= 5.2.0, < 5.2.15
Status
affected
Version
>= 5.3.0, < 5.3.7
Status
affected
Herstellercakephp
≫
Produkt
cakephp/database
Version
>= 5.1.0, < 5.1.10
Status
affected
Version
>= 5.2.0, < 5.2.15
Status
affected
Version
>= 5.3.0, < 5.3.7
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.29% | 0.214 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 9.2 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
https://github.com/cakephp/cakephp/security/advisories/GHSA-fxf7-vhh8-7vpq
https://github.com/cakephp/cakephp/commit/138f2f61486532c29ee4d106da2a9848c1ff1ab3
https://github.com/cakephp/cakephp/commit/489a40fb7c6e597af33fe0f7264047afccb90d55
https://github.com/cakephp/cakephp/commit/9f1ad970a3b72293d4a37e694276645f804e819f
https://github.com/cakephp/cakephp/releases/tag/5.1.10
https://github.com/cakephp/cakephp/releases/tag/5.2.15
https://github.com/cakephp/cakephp/releases/tag/5.3.7