Cakephp - vulnerabilities (CVEs)
18 CVEs in 5 products, 0 in the last 30 days, newest from 2026-09-17.
Products
- Cakephp - 11 CVEs
- Authentication - 2 CVEs
- Cakephpdatabase - 1 CVEs
- Debug Kit - 1 CVEs
- Queue - 1 CVEs
Newest CVEs of Cakephp
- CVE-2026-79752 - CVSS 9.2 (critical), 2026-09-17: CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract,…
- CVE-2026-54713 - CVSS 3.7 (low), 2026-08-27: CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with…
- CVE-2026-54614 - CVSS 4.3 (medium), 2026-08-26: DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in…
- CVE-2026-77337 - CVSS 9.1 (critical), 2026-08-24: CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through…
- CVE-2026-77634 - CVSS 8.2 (high), 2026-08-24: CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail…
- CVE-2026-77635 - CVSS 9.2 (critical), 2026-08-24: CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue()…
- CVE-2026-55590 - CVSS 6.1 (medium), 2026-07-09: CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the…
- CVE-2026-48820 - CVSS 6.3 (medium), 2026-06-17: CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0…
- CVE-2026-23643 - CVSS 5.4 (medium), 2026-01-16: CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string…
- CVE-2023-22727 - CVSS 9.8 (critical), 2023-01-17: CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are…
- CVE-2020-35239 - CVSS 8.8 (high), 2021-01-26: A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks…
- CVE-2019-11458 - CVSS 7.5 (high), 2019-05-08: An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting…
- CVE-2016-4793 - CVSS 7.5 (high), 2017-01-23: The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
- CVE-2015-8379 - CVSS 8.8 (high), 2016-01-26: CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
- CVE-2011-3712 - CVSS 5 (medium), 2011-09-23: CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error…
- CVE-2010-4335 - CVSS 7.5 (high), 2011-01-14: The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal…
- CVE-2006-5031 - CVSS 5 (medium), 2006-09-27: Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read…
- CVE-2006-4067 - CVSS 4.3 (medium), 2006-08-10: Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML…
