ShellCodeX
Tools • Events • News • Insights
 SEO Checker
ShellCodeX vulnerability brief
CRITICAL Received

CVE-2026-77635

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

Published 24 Aug 2026, 21:17 UTC Last modified 24 Aug 2026, 21:17 UTC
SCX

ShellCodeX risk assessment

Urgent remediation priority based on exploitation evidence, CVSS conditions and affected-product data.

PriorityEvidenceDecision use
Urgent The vulnerable path is reachable over a network. Validate against your asset inventory and vendor advisory.
Urgent Exploitation does not require prior privileges. Validate against your asset inventory and vendor advisory.
01

Attack profile

The conditions required to exploit this vulnerability and its potential impact.

Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Not assessed
Confidentiality Not assessed
Integrity Not assessed
Availability Not assessed
02

Affected products

Product applicability statements supplied with the NVD record.

NVD has not published structured affected-product data for this record.
03

Weakness classification

CWE categories help security teams group the underlying software weakness.

CWECWE-89
04

Source references

External advisories, patches and technical reports attached to this CVE record.

NVD National Vulnerability Database recordnvd.nist.gov 01 Technical reference security-advisories@github.com 02 Technical reference security-advisories@github.com 03 Technical reference security-advisories@github.com 04 Technical reference security-advisories@github.com 05 Technical reference security-advisories@github.com 06 Technical reference security-advisories@github.com 07 Technical reference security-advisories@github.com