VulnSocial

CVE-2026-79752Patch

MEDIUMCVSS 9.2 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • PoC mentioned or linked in 2 signals
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked 2d ago at 1 mentions (2026-09-17); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-17: 1Mentions · 2026-09-19: 1Mentions · 2026-09-20: 1PoC Mentioned / Linked · 2026-09-19: 1PoC Mentioned / Linked · 2026-09-20: 1Exploit Tool / Code · 2026-09-19: 1Patch / Workaround · 2026-09-17: 1Technical Details · 2026-09-19: 1Technical Details · 2026-09-20: 109-1709-1909-20
Signal classification3 categories
Patch
133.3%
Exploit
133.3%
PoC
133.3%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-09-171
Patch1
2026-09-191
Exploit1
2026-09-201
PoC1
Full discourse3 posts
  • Rıdvan Yağlı@ridvanyagli
    PoC

    🔴 CakePHP'de CVSS 9.2 seviyesinde iki kritik SQL Injection açığı için @abraxas_null tarafından public PoC yayınlandı: • CVE-2026-77635 — PostgreSQL / jsonPath • CVE-2026-79752 — cast() / dataType Her iki açık da uygun uygulama koşullarında kimlik doğrulaması gerektirmeden SQL Injection'a yol açabiliyor. PoC: http://github.com/abraxas/CVE-2026-77635 http://github.com/abraxas/CVE-2026-79752

    Post summary

    Public PoCs for two critical CakePHP SQL Injection flaws (CVSS 9.2) were released by @abraxas_null with direct GitHub links; no patch or active exploitation evidence is mentioned.

    0712671.8K
    2.5K followersView on X
  • abraxas@abraxas_null
    Exploit

    something different! CVE-2026-79752 - CakePHP - Critical 9.2 - SQL Injection - Unauth RCE exploit: https://github.com/abraxas/CVE-2026-79752 write-up (with infra): https://abraxaslabs.tech/research/cve-2026-79752

    Post summary

    The tweet announces CVE-2026-79752 (CakePHP SQL Injection leading to Unauth RCE) and links to a public exploit repository, emphasizing the availability of functional exploit code rather than just a PoC.

    20041211
    636 followersView on X
  • CVE@CVEnew
    Patch

    CVE-2026-79752 CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilde… https://www.cve.org/CVERecord?id=CVE-2026-79752

    Post summary

    The tweet discloses CVE‑2026‑79752 in CakePHP and notes that versions prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7 are affected, indicating the vulnerability has been patched in those releases.

    00000958
    58.1K followersView on X

Explore more

Back to dashboard