Cakephp (Cakefoundation) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 414 known versions, newest CVE from 2020-06-30. Vendor: Cakefoundation.

CVEs of Cakephp

• CVE-2020-15400 - CVSS 4.3 (medium), 2020-06-30: CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
• CVE-2012-4399 - CVSS 7.5 (high), 2012-10-09: The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity…
• CVE-2010-4335 - CVSS 7.5 (high), 2011-01-14: The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal…