7 matches found
CVE-2026-119419
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation can append SQL after the...
CVE-2026-119419
CakePHP versions through 5.4.3 are vulnerable to an SQL Injection flaw in the StringExpression and IdentifierExpression components. The root cause is the use of unvalidated collation values; an attacker who controls a collation name passed to the constructor or the setCollation() method can appen...
CVE-2026-119419 CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation can append SQL after the...
EUVD-2026-113799
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation can append SQL after the...
PT-2026-133472
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation can append SQL after the...
cakephp-collate-sqli
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cakephp-collate-sqli Write-up: https://abraxaslabs.tech/research/cakephp-collate-sqli cakephp-collate-sqli Class: SQLi Reach: Remote CakePHP 5.4.2 887b641 - Cake Software Foundation StringExpression::sql binds the...
