Cakephp
8 CVEs across 2 Cakephp products. Browse Cakephp vulnerabilities, severities, and proof-of-concept exploits.
Cakephp products with known CVEs
Cakephp CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-55590 | Medium | 6.1 | 2026-07-09 | CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Prior to 2.11.1, 3.3.6, and 4.1.1, the getLog… |
CVE-2026-48820 | | | 2026-06-17 | CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 thr… |
CVE-2026-23643 | Medium | 5.4 | 2026-01-16 | CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string paramete… |
CVE-2023-22727 | Critical | 9.8 | 2023-01-17 | CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vu… |
CVE-2020-35239 | High | 8.8 | 2021-01-26 | A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks… |
CVE-2019-11458 | High | 7.5 | 2019-05-08 | An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon… |
CVE-2016-4793 | High | 7.5 | 2017-01-23 | The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. |
CVE-2015-8379 | High | 8.8 | 2016-01-26 | CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter. |
CVE-2011-3712 | | | 2011-09-23 | CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error mess… |
CVE-2010-4335 | | | 2011-01-14 | The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal C… |
CVE-2006-5031 | | | 2006-09-27 | Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary… |
CVE-2006-4067 | | | 2006-08-10 | Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via… |