Cakefoundation

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Cakefoundation records in CISA KEV

No Cakefoundation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Cakephp 3 records HIGH

Records

3 records in Cakephp · all components

TI-2010-04068 CVE-2010-4335 · GHSA-g2vx-8v47-4vhh

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x…

HIGH 66

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Toke…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.55204 Published 2011-01-14 Fixed in 1.3.6 CWE-20

TI-2012-03742 CVE-2012-4399 · GHSA-5964-pq8r-4q62

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote…

MEDIUM 47

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.12091 Published 2012-10-09 Fixed in 2.1.5, 2.2.1 CWE-611

TI-2020-12145 CVE-2020-15400 · GHSA-j33j-fg2g-mcv2

CakePHP before 4.0.6 mishandles CSRF token generation.

LOW 20

CakePHP before 4.0.6 mishandles CSRF token generation.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00446 Published 2020-06-30 Fixed in 4.0.6, 3.10.3 CWE-352

Open these records in search →

Critical	0
High	2
Medium	1
Low	0
No CVSS	0