p PatchFirst

PatchFirst · Latest vulnerabilities

cakephp/database vulnerabilities

Vulnerabilities published for cakephp/database in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 3

  1. CVE-2026-79752

    Critical · CVSS 9.2EPSS 0.62%Public exploitFix available

    CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

    CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

    cakephp/database cakephp/database cakephp/database cakephp/database cakephp/databasePHP
    • Update to 4.5.12
    • Update to 4.6.5
    • Update to 5.1.9
    • Update to 5.2.14
    • Update to 5.3.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2026-77635

    Critical · CVSS 9.2EPSS 0.49%Public exploitFix available

    CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

    CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

    cakephp/database cakephp/database cakephp/databasePHP
    • Update to 5.1.10
    • Update to 5.2.15
    • Update to 5.3.7
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  3. CVE-2023-22727

    Critical · CVSS 9.8EPSS 0.86%Fix available

    Database Query::offset() and limit() vulnerable to SQL injection in cakephp

    CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.

    cakephp/database cakephp/database cakephp/databasePHP
    • Update to 4.2.12
    • Update to 4.3.11
    • Update to 4.4.10
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →