JSONPath

（開発依存関係のライセンスも参照してください：licenses for dev. deps.） JSONPath Plus JSONドキュメント（およびJavaScriptオブジェクト）からデータを分析、変換、選択的に抽出します。 jsonpath-plus は元の仕様を拡張し、いくつかの追加演算子を加え、元の仕様が明確にしていなかった動作を明示します。 ブラウザデモ または Runkit Node をお試しください。...

cve-2024-21534

POC - CVE-2024-21534 Jsonpath-plus vulnérable à l'exécution de code à distance RCE en raison d'une désinfection incorrecte des entrées Aperçu CVE-2024-21534 est une vulnérabilité critique présente dans les versions du package jsonpath-plus antérieures à la version 10.0.0. La vulnérabilité provien...

CVE-2025-1302

CVE-2025-1302 ★ CVE-2025-1302 JSONPath-plus RCE PoC ★ https://github.com/user-attachments/assets/5d791540-ef6c-4cd0-bd25-7a1dbbd194fb Настройка лаборатории root@kitploit: docker build -t jsonpath:10.2.0 . docker run --rm --name jsonpath -p 3000:3000 jsonpath:10.2.0 localhost:3000 Описание Версии...

CVE-2024-21534-poc

Vulnerability: CVE-2024-21534 Severity: Kritisch CVSS Score: 9.8 Description: Das Paket jsonpath-plus Versionen = 10.0.7 ist anfällig für eine Remote-Code-Ausführung RCE Schwachstelle, die es Angreifern ermöglicht, beliebigen Code über das VM-Modul von Node.js auszuführen. Diese Schwachstelle wir...

JSONPath Plus < 10.3.0 - Remote Code Execution

Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution RCE due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of eval='safe' mode. Note: This is caused by an incomplete fix for...

CVE-2024-21534

CVE-2024-21534: Vulnerabilità di Esecuzione Remota di Codice in jsonpath-plus =10.0.7 Riepilogo Questo repository contiene un exploit Proof of Concept PoC per una vulnerabilità critica di Esecuzione Remota di Codice RCE nel pacchetto jsonpath-plus, che interessa le versioni precedenti alla 10.0.7...

CVE-2025-1302_jsonpath-plus_RCE

CVE-2025-1302 JSONPath-Plus RCE PoC Nome dello script PoC: poc.py Uno script exploit proof-of-concept per CVE-2025-1302, che mira a una vulnerabilità RCE nella libreria jsonpath-plus. Quando viene eseguito contro un endpoint di servizio vulnerabile, lo script tenta di innescare l'esecuzione remot...

CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2026-77635 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in...

CVE-2026-77635

CakePHP , a PHP rapid development framework, is affected by a SQL injection in FunctionsBuilder::jsonValue() when used with PostgresDriver. The vulnerability occurs when user-controlled data is supplied to the jsonPath parameter, allowing an unauthenticated remote attacker to inject arbitrary SQL...

PT-2026-81036

Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 5.1.10 CakePHP versions prior to 5.2.15 CakePHP versions prior to 5.3.7 Description When using the PostgresDriver, the FunctionsBuilder::jsonValue function is susceptible to SQL injection. This occurs when...

ROOT-APP-NPM-CVE-2025-1302 CVE-2025-1302 in jsonpath-plus - Patched by Root

Root has patched CVE-2025-1302 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-21534 CVE-2024-21534 in jsonpath-plus - Patched by Root

Root has patched CVE-2024-21534 in the jsonpath-plus package for Root:npm. Multiple fixed versions available...

CLSA-2026-1780966310 TuxCare security update for jsonpath-plus (8 CVEs)

TuxCare rebuilt jsonpath-plus to address 8 CVEs. Fixed in 5.1.0-tuxcare.1...

CLSA-2026-1774657371 TuxCare security update for jsonpath-plus (24 CVEs)

TuxCare rebuilt jsonpath-plus to address 24 CVEs. Fixed in 7.2.0-tuxcare.1...

CVE-2026-45756

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match and search filter patterns directly into pregmatch without a length cap, i-regexp restriction, or...

CVE-2026-45756

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match and search filter patterns directly into pregmatch without a length cap, i-regexp restriction, or...

CVE-2026-45756

Summary (CVE-2026-45756) : The Symfony JsonPath component allows attacker-controlled regular expressions in the match() and search() filters to be compiled directly into PCRE without length or backtracking limits, enabling catastrophic backtracking (ReDoS) and denial of service. Affected are Symf...

CVE-2026-45756 Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match and search filter patterns directly into pregmatch without a length cap, i-regexp restriction, or...

CVE-2026-45756 Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.3.0-BETA1 until 7.4.12 and 8.0.12, the JsonPath component compiles attacker-controlled match and search filter patterns directly into pregmatch without a length cap, i-regexp restriction, or...