CVE-2026-77635

abraxaslabs.tech · github.com/abraxas · @abraxasnull · CVE-2026-77635 CVE-2026-77635 CakePHP 5.2.13 — cakephp CakePHP は PHP 向けの高速開発フレームワークです。各リリースラインのバージョン 5.1.10、5.2.15、5.3.7 より前では、PostgresDriver を使用した FunctionsBuilder::jsonValue において、ユーザー制御のデータが jsonPath パラメータに渡された場合に SQL...

CVE-2026-77635: Improper Neutralization of Special Elements used in an SQL Command

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

PT-2026-81036

Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 5.1.10 CakePHP versions prior to 5.2.15 CakePHP versions prior to 5.3.7 Description When using the PostgresDriver, the FunctionsBuilder::jsonValue function is susceptible to SQL injection. This occurs when...