Skip to content
OpenAdvisories

Vendor

cakephp

15 known vulnerabilities.

Products

cakephp 11 authentication 2 queue 1 debug_kit 1 cakephp/database 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-119419

    CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

    CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCo…

    cakephp cakephp cakephp Ubuntu
  • High 8.1
    CVE-2026-119418

    CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

    CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding…

    cakephp cakephp cakephp Ubuntu
  • High 8.2
    CVE-2026-77634

    CakePHP: SmtpTransport vulnerable to CRLF header injection

    CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowi…

    cakephp cakephp cakephp cakephp Debian Ubuntu