CVE-2026-77635Suited to automated attack · CISA

CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

CVSS score

9.2

EPSS probability

%0.5

Risk score

0.0

Published

1 mo ago

Overview Public Exploits (1)Newsroom Vulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

abraxas/CVE-2026-77635

GitHub

CVE-2026-77635 - CakePHP - Critical 9.2 - Unauthenticated GET /?path= - SQL Injection

Public PoCSource updated: 07.10.2026 01:06:04

Similar Vulnerabilities

8.8

CVE-2026-56828

Shopper: privilege escalation via improper Livewire admin component authorization

VendorpackagistProductshopper/framework

Patch verified1 mo ago

7.1

CVE-2026-61450

Grav before 2.0.2 Config Exfiltration via offsetGet Filter

VendorgetgravProductgrav+2 etkilenen

Patch verifiedEPSS %53 mo ago

3.5

CVE-2026-44701

OpenSTAManager has HTML Injection in modules/utenti/edit.php

VendorpackagistProductdevcode-it/openstamanager

Patch status unknown1 mo ago

7.5

CVE-2026-55584

phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

VendorphpsysinfoProductphpsysinfo+8 etkilenen

Patch status unknown Public Exploits:3EPSS %21 mo ago

8.6

CVE-2026-55182

LibreNMS: Remote Code Execution by Signal Alert Transportation Module

VendorlibrenmsProductlibrenms+2 etkilenen

Patch verifiedEPSS %21 mo ago

8.0

CVE-2026-53932

Command injection

VendorpackagistProductwnx/laravel-backup-restore

Patch verifiedEPSS %21 mo ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-77635"