Skip to content
OpenAdvisories

Package · Ubuntu

cakephp

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-119416

    CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

    CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one en…

    cakephp cakephp cakephp Ubuntu
  • Medium 6.3
    CVE-2026-48820

    CakePHP: View::element() is missing a path containment check

    CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the …

    cakephp cakephp cakephp/cakephp cakephp Debian Ubuntu Packagist
  • Medium 5.4
    CVE-2026-23643

    CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

    CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

    cakephp cakephp cakephp/cakephp cakephp Ubuntu Packagist
  • Medium 4.3
    CVE-2020-15400

    Cross-Site Request Forgery in CakePHP

    CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.

    cakephp/cakephp cakephp cakephp Debian Ubuntu Packagist