Skip to content
Threat Feed
Subscribe

Product

CakePHP (<= 5.4.3)

2 briefs RSS
high advisory

CakePHP: SQL injection in StringExpression and IdentifierExpression (CVE-2026-119419)

CakePHP through version 5.4.3 contains an SQL injection vulnerability in its query building components that allows unvalidated collation values to trigger arbitrary SQL execution.

CakePHP web-application-vulnerability sqli
1t 1c
high advisory

CakePHP: SQL injection in WindowExpression (CVE-2026-119418)

CakePHP versions through 5.4.3 contain an SQL injection vulnerability in the WindowExpression::range() and frame() methods that allows attackers to execute arbitrary SQL via crafted input passed to the OVER clause.

CakePHP sql-injection vulnerability web-framework
1t 1c