CVE-2026-119419criticalCWE-89

CVE-2026-119419: falha crítica em cakephp

CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar cakephp

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.4%
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
cakephp · cakephp
CVEs relacionadas — cakephp

No mesmo produto, das mais perigosas para as menos.

CVE-2023-22727CRITICALDatabase Query::offset() and limit() vulnerable to SQL injection in cakephpEPSS 0.9%CVE-2026-79752CRITICALCakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectionEPSS 0.6%CVE-2026-77635CRITICALCakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriverEPSS 0.5%CVE-2026-119418CRITICALCakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()EPSS 0.5%CVE-2026-119417MEDIUMCakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransportEPSS 0.5%CVE-2026-119415MEDIUMCakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-TypeEPSS 0.4%