CVE-2026-77635 in CakePHP
Riassunto
di MITRE • 25/08/2026
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.