PatchClock

PHP security digest · Packages

cakephp/database security advisories

2 advisories we have followed since September 2026, 2 of them critical or high, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Critical 17 Sep 2026

    CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

    Fixed in 4.5.12, 4.6.5, 5.1.9, 5.2.14 · CVE-2026-79752

  2. Critical 8 Sep 2026

    CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

    Fixed in 5.3.7, 5.2.15, 5.1.10 · CVE-2026-77635

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including cakephp/database, and the version that fixes it.