CVE-2026-77635

CakePHP , a PHP rapid development framework, is affected by a SQL injection in FunctionsBuilder::jsonValue() when used with PostgresDriver. The vulnerability occurs when user-controlled data is supplied to the jsonPath parameter, allowing an unauthenticated remote attacker to inject arbitrary SQL...