https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 18:22:32 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-77635 <p>CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.</p> <p>CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.</p> https://db.gcve.eu/vuln/fkie_cve-2026-77635 https://db.gcve.eu/vuln/ghsa-fxf7-vhh8-7vpq <p><strong>Affected:</strong> Packagist: cakephp/cakephp, Packagist: cakephp/database</p> <p>### Impact The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter.</p> <p>### Patches 5.1.10, 5.2.15, 5.3.7</p> <p>### Workarounds Don&#39;t provide user controlled data to these functions/parameters.</p> <p><strong>Affected:</strong> Packagist: cakephp/cakephp, Packagist: cakephp/database</p> <p>### Impact The `FunctionsBuilder::jsonValue($field, $jsonPath)` methods with the Postgres driver is vulnerable to SQL injection if user controlled data is supplied to the `$jsonPath` parameter.</p> <p>### Patches 5.1.10, 5.2.15, 5.3.7</p> <p>### Workarounds Don&#39;t provide user controlled data to these functions/parameters.</p> https://db.gcve.eu/vuln/ghsa-fxf7-vhh8-7vpq https://db.gcve.eu/vuln/ubuntu-cve-2026-77635 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: cakephp, Ubuntu:20.04:LTS: cakephp, Ubuntu:22.04:LTS: cakephp</p> <p>CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: cakephp, Ubuntu:20.04:LTS: cakephp, Ubuntu:22.04:LTS: cakephp</p> <p>CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-77635