Skip to content
OpenAdvisories

Package · Packagist

cakephp/cakephp

22 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2016-4793 Public exploit

    CakePHP allows remote attackers to spoof their IP

    The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

    cakephp/cakephp cakephp cakephp Debian Ubuntu Packagist
  • High 7.5
    CVE-2012-4399 Public exploit EPSS 12%

    CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references

    The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

    cakephp/cakephp Packagist
  • High —
    CVE-2010-4335 Public exploit EPSS 55%

    CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code

    The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by t…

    cakephp/cakephp cakephp Debian Packagist