Cake Software Foundation

CakePHP through version 5.4.3 contains an SQL injection vulnerability in its query building components that allows unvalidated collation values to trigger arbitrary SQL execution.