p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de cakephp/database

Vulnerabilidades publicadas para cakephp/database en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 3

  1. CVE-2026-79752

    Crítica · CVSS 9.2EPSS 0,62%Código de explotación públicoCorrección disponible

    CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

    CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

    cakephp/database cakephp/database cakephp/database cakephp/database cakephp/databasePHP
    • Actualiza a 4.5.12
    • Actualiza a 4.6.5
    • Actualiza a 5.1.9
    • Actualiza a 5.2.14
    • Actualiza a 5.3.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-77635

    Crítica · CVSS 9.2EPSS 0,49%Código de explotación públicoCorrección disponible

    CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

    CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

    cakephp/database cakephp/database cakephp/databasePHP
    • Actualiza a 5.1.10
    • Actualiza a 5.2.15
    • Actualiza a 5.3.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2023-22727

    Crítica · CVSS 9.8EPSS 0,86%Corrección disponible

    Database Query::offset() and limit() vulnerable to SQL injection in cakephp

    CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.

    cakephp/database cakephp/database cakephp/databasePHP
    • Actualiza a 4.2.12
    • Actualiza a 4.3.11
    • Actualiza a 4.4.10
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →