{"metadata": {"vulnerability": "CVE-2026-119419", "count": 19, "kinds": {"milestone": 5, "sighting": 4, "kev": 0, "other": 10}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119419", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T02:41:11.857Z", "date_only": false, "value": "2026-10-30T02:41:11.857Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-119419", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-30T11:30:50.862Z", "date_only": false, "value": "2026-10-30T11:30:50.862Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-119419", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T11:30:50.862Z", "date_only": false, "value": "2026-10-30T11:30:50.862Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119419", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T11:46:42.374Z", "date_only": false, "value": "2026-10-30T11:46:42.374865Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117529693513108789", "record": "CVE-2026-119419", "field": "creation_timestamp", "uuid": "1ddd0a55-8cf9-4dc5-a406-fad3bd076bcb", "content": "CVE-2026-119419 CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCollation() can append SQL after the unquoted COLLATE clause, affecting every database driver within the connection's privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-119419https://github.com/cakephp/cakephp/commit/ae8c354cf825aeb7090ea4b48ce98142446f3ac9https://github.com/cakephp/cakephp/commit/21951faea40060dcc5cc1da3159056df66816d3chttps://github.com/cakephp/cakephp/commit/d04d342c3d1e0bac7ce7661bc098902cc412e595https://github.com/cakephp/cakephp/commit/ac07372e6a3045ce2030701a5bc5ed71aa2b4b82https://github.com/cakephp/cakephp/pull/19726https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/StringExpression.php#L77https://github.com/cakephp/cakephp/blob/6f3dd91371ac0698b64024ddb21d57def9fbba91/src/Database/Expression/IdentifierExpression.php#L106https://abraxaslabs.tech/research/cakephp-collate-sqlihttps://github.com/cakephp/cakephphttps://www.vulncheck.com/advisories/cakephp-through-5.4.3-sql-injection-via-stringexpression-and-identifierexpression-collation#cakephp#CVE_2026_119419#bot", "url": "https://infosec.exchange/users/cve/statuses/117529693513108789"}, {"timestamp": "2026-10-30T12:16:00Z", "date_only": false, "value": "2026-10-30T12:16:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-119419", "record": "UBUNTU-CVE-2026-119419", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:16:38Z", "date_only": false, "value": "2026-10-30T12:16:38Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6Q38-2QCR-3X34", "record": "GHSA-6Q38-2QCR-3X34", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-30T12:16:38.550Z", "date_only": false, "value": "2026-10-30T12:16:38.550", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119419", "record": "FKIE_CVE-2026-119419", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:31:18Z", "date_only": false, "value": "2026-10-30T12:31:18Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6Q38-2QCR-3X34", "record": "GHSA-6Q38-2QCR-3X34", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-30T12:31:18Z", "date_only": false, "value": "2026-10-30T12:31:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6Q38-2QCR-3X34", "record": "GHSA-6Q38-2QCR-3X34", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T13:00:08.509Z", "date_only": false, "value": "2026-10-30T13:00:08.509601Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mz3tk4cs2m2n", "record": "CVE-2026-119419", "field": "creation_timestamp", "uuid": "63022a56-a8b6-4c86-b4dc-7b467fe36b77", "content": "CVE-2026-119419 - cakephp\nThe CakePHP framework up to version 5.4.3 does not properly check the collation name that developers can pass to certain functions. An attacker who can supply a malicious collation value\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#cakephp #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mz3tk4cs2m2n"}, {"timestamp": "2026-10-30T14:07:28.205Z", "date_only": false, "value": "2026-10-30T14:07:28.205005Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mz3xcj7i6k2z", "record": "CVE-2026-119419", "field": "creation_timestamp", "uuid": "535a07ec-358a-4d8a-a03b-b972bdc3a424", "content": "\ud83d\udea8 CVE-2026-119419 \u2014 CVSS 9.2 CRITICAL\n\nCakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supply...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-119419\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mz3xcj7i6k2z"}, {"timestamp": "2026-10-30T16:31:08.875Z", "date_only": false, "value": "2026-10-30T16:31:08.875375Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/b74f2lqw3w4a5", "record": "CVE-2026-119419", "field": "creation_timestamp", "uuid": "98d65b48-6af8-46ff-9c58-c544914bdb2b", "content": "\ud83d\udea8 CVE-2026-119419\nAffected product: see description\nCVSS 9.2 / KEV: No\nTL;DR: CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values\u2026\nhttps://cvesentinel.com/report/CVE-2026-119419\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/b74f2lqw3w4a5"}, {"timestamp": "2026-11-04T15:04:15.986Z", "date_only": false, "value": "2026-11-04T15:04:15.986648Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119419", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-04T15:04:15.986Z", "date_only": false, "value": "2026-11-04T15:04:15.986648Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119419", "record": "FKIE_CVE-2026-119419", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-04T15:04:44.162Z", "date_only": false, "value": "2026-11-04T15:04:44.162Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-119419", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-04T15:04:44.162Z", "date_only": false, "value": "2026-11-04T15:04:44.162Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-119419", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T15:17:40.100Z", "date_only": false, "value": "2026-11-04T15:17:40.100", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-119419", "record": "FKIE_CVE-2026-119419", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-05T04:42:52Z", "date_only": false, "value": "2026-11-05T04:42:52Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-119419", "record": "UBUNTU-CVE-2026-119419", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-13T07:30:18.387Z", "anchors": {"origin": {"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119419", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119419", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2791818.38753, "hours": 775.5051076472222, "days": 32.31271281863426, "min_seconds": 2705418.38753, "max_seconds": 2791818.38753, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-12T00:00:00Z", "date_only": false, "value": "2026-10-12T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-119419", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T07:30:18.387Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}