Cakephp vulnerabilities

Products

• Cakephp 20
• Authentication 2

Newest

• cakephp CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation CVE-2026-119419 9.2 CriticalOctober 30, 2026
• cakephp CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() CVE-2026-119418 9.2 CriticalOctober 30, 2026
• cakephp CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching CVE-2026-119416 6.3 MediumOctober 30, 2026
• cakephp CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type CVE-2026-119415 6.3 MediumOctober 30, 2026
• cakephp CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection CVE-2026-79752 Public exploitFix available 9.2 CriticalSeptember 17, 2026
• cakephp queue CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions CVE-2026-54713 Fix available 3.7 LowAugust 27, 2026
• cakephp debug kit DebugKit: MailPreview contains unsafe reflection CVE-2026-54614 Fix available 4.3 MediumAugust 26, 2026
• cakephp authentication CakePHP: Potential Authentication bypass with CookieAuthenticator CVE-2026-77337 9.1 CriticalAugust 24, 2026
• cakephp CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport CVE-2026-119417 Fix available 6.3 MediumAugust 24, 2026
• cakephp CakePHP: SmtpTransport vulnerable to CRLF header injection CVE-2026-77634 Fix available 8.2 HighAugust 24, 2026
• cakephp, cakephp cakephp/database +1 more CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver CVE-2026-77635 Public exploitFix available 9.2 CriticalAugust 24, 2026
• cakephp CakePHP: View::element() is missing a path containment check CVE-2026-48820 Fix available 6.3 MediumJune 17, 2026
• cakephp authentication, cakephp +1 more CakePHP: Open redirect weakness via backslash bypass CVE-2026-55590 Fix available 5.1 MediumJune 17, 2026
• cakephp CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting CVE-2026-23643 Fix available 5.4 MediumJanuary 16, 2026
• cakephp Database Query::offset() and limit() vulnerable to SQL injection in cakephp CVE-2023-22727 Fix available 9.8 CriticalJanuary 17, 2023
• cakephp CakePHP allows method override parameters to bypass CSRF checks CVE-2020-35239 Fix available 8.8 HighJanuary 20, 2021
• cakephp Unsafe deserialization in SmtpTransport in CakePHP CVE-2019-11458 Fix available 7.5 HighMay 8, 2019
• cakephp CakePHP allows remote attackers to spoof their IP CVE-2016-4793 Public exploitFix available 7.5 HighJanuary 23, 2017
• cakephp CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter CVE-2015-8379 Fix available 8.8 HighJanuary 26, 2016
• cakephp CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file CVE-2011-3712 Fix available 5.0 MediumSeptember 23, 2011
• cakefoundation cakephp CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code CVE-2010-4335 Public exploitFix available EPSS 55.2% 7.5 HighJanuary 14, 2011
• cakephp CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files CVE-2006-5031 Public exploitFix available 5.0 MediumSeptember 27, 2006
• cakephp Cross-site scripting (XSS) vulnerability in CakePHP CVE-2006-4067 Fix available 4.3 MediumAugust 10, 2006