cakephp/database (packagist) has 3 known vulnerabilities, the worst rated CRITICAL. Upgrade to 5.3.7 or later to clear all of them. No malicious-package signal is recorded.
The FunctionsBuilder::cast($field, $dataType), extract($part, $expr), datePart($part, $expr), dateAdd($expr, $value, $unit) methods are vulnerable to SQL…
CyberXYZ does not call a package safe in absolute terms. It records 3 known vulnerabilities for cakephp/database (packagist), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does cakephp/database have known vulnerabilities?
Yes. CyberXYZ records 3 known vulnerabilities for cakephp/database (packagist), the worst rated CRITICAL. They are GHSA-vjqc-q4mp-2rvf, GHSA-fxf7-vhh8-7vpq, GHSA-6g8q-qfpv-57wp.
Which version of cakephp/database should I use?
5.3.7 or later clears every advisory recorded for cakephp/database (packagist). Check the release you pick before installing it.
How do I check cakephp/database before installing?
Search cakephp/database in CyberXYZ Check at https://cyberxyz.io/check?q=cakephp%2Fdatabase. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 09:11 UTC. The most recent advisory here was published 2026-09-17. Updated continuously from NVD, GHSA, OSV and CNA feeds.