Security
فارسی
All products

cakephp/cakephp

Composer · Package
22 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injectionCVE-2026-79752 · GHSA-VJQC-Q4MP-2RVF cakephp/cakephpcakephp/database Composer Critical Fix reported
CakePHP: View::element() is missing a path containment checkCVE-2026-48820 · GHSA-WPVJ-HJCR-H3P2 cakephp/cakephp Composer Medium Fix reported
CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injectionCVE-2023-22727 · GHSA-6G8Q-QFPV-57WP cakephp/cakephpcakephp/database Composer Critical Fix reported
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriverCVE-2026-77635 · GHSA-FXF7-VHH8-7VPQ cakephp/cakephpcakephp/database Composer Critical Fix reported
CakePHP: SmtpTransport vulnerable to CRLF header injectionCVE-2026-77634 · GHSA-2QH5-382H-3JPC cakephp/cakephp Composer High Fix reported
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scriptingCVE-2026-23643 · GHSA-QH8M-9QXX-53M5 cakephp/cakephp Composer Medium Fix reported
Unsafe deserialization in SmtpTransport in CakePHPCVE-2019-11458 · GHSA-QHRX-HCM6-PMRWVersion ranges need review. cakephp/cakephp Composer High Fix reported
CakePHP has incorrect Cross-Site Request Forgery validationGHSA-829Q-V5G8-HHXC · PKSA-QS16-TZG5-F7MJ cakephp/cakephp Composer Medium Fix reported
CakePHP vulnerable to Cross-site Scripting in some development error pagesGHSA-XWHJ-PQCG-8RCR · PKSA-2NR2-9GYW-VYR4Version ranges need review. cakephp/cakephp Composer Medium Fix reported
CakePHP vulnerable to Remote File Inclusion through View template name manipulationGHSA-P76F-WR22-4RV6 · PKSA-XK7X-9SN9-KDZRVersion ranges need review. cakephp/cakephp Composer Medium Fix reported
CakePHP vulnerable to Denial of Service attack through XML payloadsGHSA-Q79M-C546-2G63 · PKSA-QKMW-Z6Y6-8RT4Version ranges need review. cakephp/cakephp Composer High Fix reported
CakePHP allows direct access of prefixed controller actionsGHSA-6HG4-VP5Q-47MW · PKSA-2HQH-1WCB-3XV1Version ranges need review. cakephp/cakephp Composer Medium Fix reported
CakePHP SecurityComponent cross form submission issueGHSA-J9Q2-F9Q7-JHGQ · PKSA-RXQV-21Q6-C8P8Version ranges need review. cakephp/cakephp Composer Medium Fix reported
CakePHPallows remote attackers to read arbitrary files via XML data containing external entity referencesCVE-2012-4399 · GHSA-5964-PQ8R-4Q62 cakephp/cakephp Composer High Fix reported
CakePHP allows remote attackers to spoof their IPCVE-2016-4793 · GHSA-J8P3-8M69-2HQQ cakephp/cakephp Composer High Fix reported
Cross-Site Request Forgery in CakePHPCVE-2020-15400 · GHSA-J33J-FG2G-MCV2 cakephp/cakephp Composer Medium Fix reported
CakePHP allows method override parameters to bypass CSRF checksCVE-2020-35239 · GHSA-9PGX-PF36-W46R cakephp/cakephp Composer High Fix reported
CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameterCVE-2015-8379 · GHSA-556Q-H4VR-PGH2 cakephp/cakephp Composer High Fix reported
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php fileCVE-2011-3712 · GHSA-R7P6-FR3X-R877 cakephp/cakephp Composer Medium Fix reported
CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary codeCVE-2010-4335 · GHSA-G2VX-8V47-4VHH cakephp/cakephp Composer High Fix reported