Skip to content
OpenAdvisories

Package · Debian

cakephp

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Critical 9.1
    CVE-2026-77337

    CakePHP: Potential Authentication bypass with CookieAuthenticator

    CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion…

    cakephp authentication cakephp cakephp Debian Ubuntu
  • High 8.2
    CVE-2026-77634

    CakePHP: SmtpTransport vulnerable to CRLF header injection

    CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowi…

    cakephp cakephp cakephp cakephp Debian Ubuntu
  • Critical 9.2
    CVE-2026-77635 Public exploit

    CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

    CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the json…

    cakephp cakephp cakephp/database cakephp/cakephp Debian Ubuntu Packagist
  • Medium 6.3
    CVE-2026-48820

    CakePHP: View::element() is missing a path containment check

    CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the …

    cakephp cakephp cakephp/cakephp cakephp Debian Ubuntu Packagist
  • Medium 4.3
    CVE-2020-15400

    Cross-Site Request Forgery in CakePHP

    CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.

    cakephp/cakephp cakephp cakephp Debian Ubuntu Packagist
  • High 7.5
    CVE-2016-4793 Public exploit

    CakePHP allows remote attackers to spoof their IP

    The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

    cakephp/cakephp cakephp cakephp Debian Ubuntu Packagist
  • High 8.8
    CVE-2015-8379

    CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter

    CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.

    cakephp/cakephp cakephp Debian Packagist
  • High —
    CVE-2010-4335 Public exploit EPSS 55%

    CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code

    The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by t…

    cakephp/cakephp cakephp Debian Packagist
  • Medium —
    CVE-2006-5031 Public exploit

    CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files

    Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js …

    cakephp/cakephp cakephp Debian Packagist
  • Medium 6.5
    CVE-2006-4067

    Cross-site scripting (XSS) vulnerability in CakePHP

    Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are…

    cakephp/cakephp cakephp Debian Packagist