155 matches found
JSONPath
see also licenses for dev. deps. JSONPath Plus Analyse, transform, and selectively extract data from JSON documents and JavaScript objects. jsonpath-plus expands on the original specification to add some additional operators and makes explicit some behaviors the original did not spell out. Try th...
CVE-2025-1302_jsonpath-plus_RCE
CVE-2025-1302 JSONPath-Plus RCE PoC PoC Script Name: poc.py A proof-of-concept exploit script for CVE-2025-1302, which targets an RCE vulnerability in the jsonpath-plus library. When run against a vulnerable service endpoint, the script attempts to trigger remote code execution via a JSONPath...
JSONPath Plus < 10.3.0 - Remote Code Execution
Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...
cve-2024-21534
POC - CVE-2024-21534 Jsonpath-plus vulnerable to Remote Code Execution RCE due to improper input sanitization Overview CVE-2024-21534 is a critical vulnerability found in versions of the jsonpath-plus package prior to version 10.0.0. The vulnerability stems from improper input sanitization, which...
CVE-2025-1302
CVE-2025-1302 ★ CVE-2025-1302 JSONPath-plus RCE PoC ★ https://github.com/user-attachments/assets/5d791540-ef6c-4cd0-bd25-7a1dbbd194fb Configuración del laboratorio root@kitploit: docker build -t jsonpath:10.2.0 . docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0 localhost:3000...
CVE-2026-29053
CVE-2026-29053 Ghost CMS RCE via jsonpath/static-eval prototype chain. Info CVE : CVE-2026-29053 Affected : Ghost -p 1. Start listener: nc -lvnp 2. Upload malicious-theme.zip to Ghost Admin → Settings → Design...
CVE-2024-21534
CVE-2024-21534: Remote Code Execution Vulnerability in jsonpath-plus =10.0.7 Summary This repository contains a Proof of Concept PoC exploit for a critical Remote Code Execution RCE vulnerability in the jsonpath-plus package, affecting versions prior to 10.0.7. The issue stems from improper input...
CVE-2024-21534-poc
Vulnerabilidad: CVE-2024-21534 Gravedad: Crítica Puntuación CVSS: 9.8 Descripción: El paquete jsonpath-plus versiones = 10.0.7 es vulnerable a una vulnerabilidad de Ejecución Remota de Código RCE que permite a los atacantes ejecutar código arbitrario a través del módulo VM de Node.js. Esta...
Linux Distros Unpatched Vulnerability : CVE-2026-77635
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue wit...
DEBIAN-CVE-2026-77635
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...
CVE-2026-77635
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...
CVE-2026-77635 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...
CVE-2026-77635
CakePHP , a PHP rapid development framework, is affected by a SQL injection in FunctionsBuilder::jsonValue() when used with PostgresDriver. The vulnerability occurs when user-controlled data is supplied to the jsonPath parameter, allowing an unauthenticated remote attacker to inject arbitrary SQL...
CVE-2026-77635
Removed by vendor...
CVE-2026-77635 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...
PT-2026-81036
Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 5.1.10 CakePHP versions prior to 5.2.15 CakePHP versions prior to 5.3.7 Description When using the PostgresDriver, the FunctionsBuilder::jsonValue function is susceptible to SQL injection. This occurs when...
ANT-2026-KC1Y51NF · openmeterio/openmeter · sql_injection
sql-injection medium GHSA-wc3v-3457-c8cm Severity Claude high · Security research firm high · Maintainer medium Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Anvil Security. ANT-2026-KC1Y51NF: SQL injection in...
ROOT-APP-NPM-CVE-2025-1302 CVE-2025-1302 in jsonpath-plus - Patched by Root
Root has patched CVE-2025-1302 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...