CVE Daily – CakePHP (High+Critical) https://cvedaily.com/pages/tags/cakephp.html CVE Daily – CakePHP (High+Critical) en Wed, 03 Jun 2026 21:27:01 +0000 [Critical] CVE-2023-22727 – CakePHP is a development framework for PHP web apps. In affected versions the `C... https://nvd.nist.gov/vuln/detail/CVE-2023-22727 https://nvd.nist.gov/vuln/detail/CVE-2023-22727 Tue, 17 Jan 2023 21:15:16 +0000 Critical CVE-2023-22727

CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Ma…

CVSS: 9.8 · CWE: CWE-89

View on NVD

]]> [High] CVE-2020-35239 – A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtecti... https://nvd.nist.gov/vuln/detail/CVE-2020-35239 https://nvd.nist.gov/vuln/detail/CVE-2020-35239 Tue, 26 Jan 2021 18:15:53 +0000 High CVE-2020-35239

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is a…

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [High] CVE-2019-11458 – An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized objec... https://nvd.nist.gov/vuln/detail/CVE-2019-11458 https://nvd.nist.gov/vuln/detail/CVE-2019-11458 Wed, 08 May 2019 18:29:00 +0000 High CVE-2019-11458

An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.

CVSS: 7.5 · CWE: CWE-502

View on NVD

]]> [Critical] CVE-2017-6316 – Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers ... https://nvd.nist.gov/vuln/detail/CVE-2017-6316 https://nvd.nist.gov/vuln/detail/CVE-2017-6316 Thu, 20 Jul 2017 04:29:00 +0000 Critical CVE-2017-6316

Citrix NetScaler SD-WAN devices through v9.1.2.26.561201 allow remote attackers to execute arbitrary shell commands as root via a CGISESSID cookie. On CloudBridge (the former name of NetScaler SD-WAN) devices, the cookie name was CAKEPHP rather than CGISESSID.

CVSS: 9.8 · CWE: N/A

View on NVD

]]> [High] CVE-2016-4793 – The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to sp... https://nvd.nist.gov/vuln/detail/CVE-2016-4793 https://nvd.nist.gov/vuln/detail/CVE-2016-4793 Mon, 23 Jan 2017 21:59:01 +0000 High CVE-2016-4793

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]> [High] CVE-2015-8379 – CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF... https://nvd.nist.gov/vuln/detail/CVE-2015-8379 https://nvd.nist.gov/vuln/detail/CVE-2015-8379 Tue, 26 Jan 2016 19:59:01 +0000 High CVE-2015-8379

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.

CVSS: 8.8 · CWE: CWE-352

View on NVD

]]> [High] CVE-2012-4399 – The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote... https://nvd.nist.gov/vuln/detail/CVE-2012-4399 https://nvd.nist.gov/vuln/detail/CVE-2012-4399 Tue, 09 Oct 2012 23:55:05 +0000 High CVE-2012-4399

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

CVSS: 7.5 · CWE: CWE-611

View on NVD

]]> [High] CVE-2010-4335 – The _validatePost function in libs/controller/components/security.php in CakePHP... https://nvd.nist.gov/vuln/detail/CVE-2010-4335 https://nvd.nist.gov/vuln/detail/CVE-2010-4335 Fri, 14 Jan 2011 23:00:46 +0000 High CVE-2010-4335

The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.

CVSS: 7.5 · CWE: CWE-20

View on NVD

]]> [High] CVE-2006-5594 – PHP remote file inclusion vulnerability in University of British Columbia iPeer ... https://nvd.nist.gov/vuln/detail/CVE-2006-5594 https://nvd.nist.gov/vuln/detail/CVE-2006-5594 Fri, 27 Oct 2006 18:07:00 +0000 High CVE-2006-5594

PHP remote file inclusion vulnerability in University of British Columbia iPeer 2.0, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the page parameter. NOTE: it is possible that this issue is related to CakePHP.

CVSS: 7.5 · CWE: N/A

View on NVD

]]>