https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T18:22:32.085365+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-77635 fkie_cve-2026-77635 2026-10-01T18:22:32.131505+00:00

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

 https://db.gcve.eu/vuln/ghsa-fxf7-vhh8-7vpq GHSA-fxf7-vhh8-7vpq — CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver 2026-10-01T18:22:32.131722+00:00

Affected: Packagist: cakephp/cakephp, Packagist: cakephp/database

### Impact The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter.

### Patches 5.1.10, 5.2.15, 5.3.7

### Workarounds Don't provide user controlled data to these functions/parameters.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-77635 UBUNTU-CVE-2026-77635 2026-10-01T18:22:32.131874+00:00

Affected: Ubuntu:16.04:LTS: cakephp, Ubuntu:20.04:LTS: cakephp, Ubuntu:22.04:LTS: cakephp

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.