Skip to content
OpenAdvisories

Package · Debian

cakephp

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-48820

    CakePHP: View::element() is missing a path containment check

    CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the …

    cakephp cakephp cakephp/cakephp cakephp Debian Ubuntu Packagist
  • Medium 4.3
    CVE-2020-15400

    Cross-Site Request Forgery in CakePHP

    CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.

    cakephp/cakephp cakephp cakephp Debian Ubuntu Packagist
  • Medium —
    CVE-2006-5031 Public exploit

    CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files

    Directory traversal vulnerability in app/webroot/js/vendors.php in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter, followed by a filename ending with "%00" and a .js …

    cakephp/cakephp cakephp Debian Packagist
  • Medium 6.5
    CVE-2006-4067

    Cross-site scripting (XSS) vulnerability in CakePHP

    Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are…

    cakephp/cakephp cakephp Debian Packagist