Priority HIGH 66
The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Toke…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.55204 · Published 2011-01-14 · Fixed in 1.3.6 CWE-20
Priority MEDIUM 61
CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00175 · Published 2026-10-30 · No fix listed CWE-346
Priority MEDIUM 58
CakePHP is a rapid development framework for PHP.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00281 · Published 2026-01-16 · Fixed in 5.2.12, 5.3.1 CWE-79
Priority MEDIUM 51
CakePHP is a development framework for PHP web apps.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00898 · Published 2023-01-17 · Fixed in 4.2.12, 4.3.11 +1 CWE-89
Priority MEDIUM 48
CakePHP is a rapid development framework for PHP.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00493 · Published 2026-08-24 · Fixed in 5.1.10, 5.2.15 +1 CWE-89
Priority MEDIUM 43
CakePHP is a rapid development framework for PHP.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00621 · Published 2026-09-17 · Fixed in 4.5.12, 4.6.5 +3 CWE-89
Priority MEDIUM 42
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression.
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.00394 · Published 2026-10-30 · No fix listed CWE-89
Priority MEDIUM 42
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame().
CVSS 4.0CRITICAL 9.2· Network · No auth · No interaction · EPSS 0.0048 · Published 2026-10-30 · No fix listed CWE-89
Priority MEDIUM 41
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.05146 · Published 2017-01-23 · Fixed in 2.6.13, 2.7.11 +4 CWE-20
Priority MEDIUM 41
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01401 · Published 2016-01-26 · Fixed in 3.1.5 CWE-352
Priority MEDIUM 40
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications.
CVSS 4.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00698 · Published 2026-08-24 · Fixed in 2.11.2, 3.3.7 +1 CWE-290
Priority LOW 39
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00608 · Published 2021-01-20 · Fixed in 4.0.10, 4.1.4 CWE-352
Priority LOW 37
An issue was discovered in SmtpTransport in CakePHP 3.7.6.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02002 · Published 2019-05-08 · Fixed in 3.5.18, 3.6.15 +1 CWE-502
Priority LOW 35
CakePHP is a rapid development framework for PHP.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00313 · Published 2026-08-24 · Fixed in 4.5.12, 4.6.5 +3 CWE-93
Priority LOW 33
Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a ..
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.07674 · Published 2006-09-27 · Fixed in 1.1.8.3544 CWE-22
Priority LOW 28
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header…
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00452 · Published 2026-10-30 · No fix listed CWE-93
Priority LOW 28
CakePHP through 5.4.3 contains a header injection vulnerability in FormDataPart that allows attackers to inject MIME part headers via unsanitized Content-Type and Content-ID values.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.0037 · Published 2026-10-30 · No fix listed CWE-93
Priority LOW 28
CakePHP is a rapid development framework for PHP.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00258 · Published 2026-06-17 · Fixed in 5.3.6, 5.2.13 +3 CWE-22
Priority LOW 26
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other file…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.0158 · Published 2011-09-23 · Fixed in 1.3.8 CWE-200
Priority LOW 24
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications.
CVSS 4.0MEDIUM 5.1· Network · No auth · User interaction · EPSS 0.00491 · Published 2026-07-09 · Fixed in 2.11.1, 3.3.6 +1 CWE-601
Priority LOW 22
Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") erro…
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01207 · Published 2006-08-10 · Fixed in 1.1.7.3363 CWE-79
Priority LOW 21
DebugKit provides a debugging toolbar for CakePHP applications.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00536 · Published 2026-08-26 · Fixed in 4.10.3, 5.2.4 CWE-470
Priority LOW 18
CakePHP Queue is a queue-interop compatible queueing library.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00461 · Published 2026-08-27 · Fixed in 2.3.1 CWE-1023
THREATIST.IORead the docs