CVE-2026-119418
High · 8.1CVSS
8.1
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding user input into the OVER clause to execute SQL with the database connection's privileges.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63224 OpenRemote is an open-source internet-of-things platform. CWE-89
- CVE-2026-62849 ThingLinks is an enterprise IoT platform. CWE-89
- CVE-2026-61620 HoneySQL turns Clojure data structures into SQL. CWE-89
- CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. CWE-89
- CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to… CWE-89
- CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for… CWE-89
- CVE-2026-119656 CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection… CWE-89
- CVE-2026-119655 CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the… CWE-89