8.1
HighCVSS 3.1 · from VulnCheck
CVE-2026-119418
CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()
cakephp · SQL injection · CWE-89Affectedcakephp
FixA patch is linked in the references.
PublishedOct 30, 11:30 · VulnCheck
ScoredOct 30 · 8.1 · VulnCheck
Exploit code publicNone known · checked 00:19 UTC
ExploitedNone known · CISA KEV checked 01:03 UTC
What we know
No known exploitation. CISA KEV, checked 01:03 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 00:19 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can read and change data and take the service down. CVSS: high impact on confidentiality, integrity and availability.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed incakephpup to 5.4.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known