Critical
CVE-2026-79752
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 22
Reset filters
Critical
CVE-2026-77635
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
High
CVE-2026-77634
CakePHP: SmtpTransport vulnerable to CRLF header injection
Medium
CVE-2026-48820
CakePHP: View::element() is missing a path containment check
Medium
CVE-2026-23643
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
Medium
ghsa-xwhj-pqcg-8rcr
CakePHP vulnerable to Cross-site Scripting in some development error pages
Medium
ghsa-p76f-wr22-4rv6
CakePHP vulnerable to Remote File Inclusion through View template name manipulation
Medium
ghsa-6hg4-vp5q-47mw
CakePHP allows direct access of prefixed controller actions
High
ghsa-q79m-c546-2g63
CakePHP vulnerable to Denial of Service attack through XML payloads
Medium
ghsa-j9q2-f9q7-jhgq
CakePHP SecurityComponent cross form submission issue
Medium
ghsa-829q-v5g8-hhxc
CakePHP has incorrect Cross-Site Request Forgery validation
Critical
CVE-2023-22727
CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection
High
CVE-2020-35239
CakePHP allows method override parameters to bypass CSRF checks
High
CVE-2010-4335
CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code
Medium
CVE-2011-3712
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file
High
CVE-2012-4399
CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references
High
CVE-2015-8379
CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter
High
CVE-2016-4793
CakePHP allows remote attackers to spoof their IP
Medium
CVE-2006-5031
CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files
Medium
CVE-2006-4067
Cross-site scripting (XSS) vulnerability in CakePHP
Medium
CVE-2020-15400
Cross-Site Request Forgery in CakePHP
High
CVE-2019-11458
Unsafe deserialization in SmtpTransport in CakePHP
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.