Vulnerabilities

TI-2026-40127 CVE-2026-55590 · GHSA-hhpq-7wg4-36jm

CakePHP: Open redirect weakness via backslash bypass

LOW 24

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00491 Published 2026-07-09 Fixed in 2.11.1, 3.3.6 +1 CWE-601

TI-2026-19037 CVE-2026-23643 · GHSA-qh8m-9qxx-53m5

CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

MEDIUM 58

CakePHP is a rapid development framework for PHP.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00281 Published 2026-01-16 Fixed in 5.2.12, 5.3.1 CWE-79

TI-2023-08901 CVE-2023-22727 · GHSA-6g8q-qfpv-57wp

Database Query::offset() and limit() vulnerable to SQL injection in cakephp

MEDIUM 51

CakePHP is a development framework for PHP web apps.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00898 Published 2023-01-17 Fixed in 4.2.12, 4.3.11 +1 CWE-89

TI-2020-17913 CVE-2020-35239 · GHSA-9pgx-pf36-w46r

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3.

LOW 39

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00608 Published 2021-01-20 Fixed in 4.0.10, 4.1.4 CWE-352

TI-2019-08553 CVE-2019-11458 · GHSA-qhrx-hcm6-pmrw

An issue was discovered in SmtpTransport in CakePHP 3.7.6.

LOW 37

An issue was discovered in SmtpTransport in CakePHP 3.7.6.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02002 Published 2019-05-08 Fixed in 3.5.18, 3.6.15 +1 CWE-502

TI-2016-04142 CVE-2016-4793 · GHSA-j8p3-8m69-2hqq

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their…

MEDIUM 41

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.05146 Published 2017-01-23 Fixed in 2.6.13, 2.7.11 +4 CWE-20

TI-2015-06899 CVE-2015-8379 · GHSA-556q-h4vr-pgh2

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF…

MEDIUM 41

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01401 Published 2016-01-26 Fixed in 3.1.5 CWE-352

TI-2011-03269 CVE-2011-3712 · GHSA-r7p6-fr3x-r877

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct…

LOW 26

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other file…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.0158 Published 2011-09-23 Fixed in 1.3.8 CWE-200

TI-2010-04068 CVE-2010-4335 · GHSA-g2vx-8v47-4vhh

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x…

HIGH 66

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Toke…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.55204 Published 2011-01-14 Fixed in 1.3.6 CWE-20

TI-2006-04847 CVE-2006-5031 · GHSA-rw73-xmpv-j5x2

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software…

LOW 33

Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07674 Published 2006-09-27 Fixed in 1.1.8.3544 CWE-22

TI-2006-03942 CVE-2006-4067 · GHSA-vc29-mvwv-wpcq

Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before…

LOW 22

Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") erro…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01207 Published 2006-08-10 Fixed in 1.1.7.3363 CWE-79

Vulnerabilities

Filters