cakephp/database vulnerabilities

Latest cakephp/database CVEs

Newest publication first

1. CVE-2026-79752 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

   Published 2026-09-17

   Critical·CVSS 9.2 EPSS 0.62%

   CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, p...

2. CVE-2026-77635 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

   Published 2026-08-24

   Critical·CVSS 9.2 EPSS 0.49%

   CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This...

3. CVE-2023-22727 Database Query::offset() and limit() vulnerable to SQL injection in cakephp

   Published 2023-01-17

   Critical·CVSS 9.8 EPSS 0.90%

   CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. User...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.