p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de cakephp/cakephp

Vulnerabilidades publicadas para cakephp/cakephp en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 22

  1. CVE-2026-79752

    Crítica · CVSS 9.2EPSS 0,62%Código de explotación públicoCorrección disponible

    CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

    CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-controlled dataType, part, or unit values and incorporate them into generated SQL as unescaped structural fragments. An application that passes untrusted input to these parameters can permit SQL injection with confidentiality, integrity, and availability impact according to the database connection's privileges. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7.

    cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 4.5.12
    • Actualiza a 4.6.5
    • Actualiza a 5.1.9
    • Actualiza a 5.2.14
    • Actualiza a 5.3.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-77634

    Alta · CVSS 8.2EPSS 0,54%Corrección disponible

    CakePHP: SmtpTransport vulnerable to CRLF header injection

    CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

    cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 4.5.12
    • Actualiza a 4.6.5
    • Actualiza a 5.1.9
    • Actualiza a 5.2.14
    • Actualiza a 5.3.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-77635

    Crítica · CVSS 9.2EPSS 0,49%Código de explotación públicoCorrección disponible

    CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

    CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

    cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 5.1.10
    • Actualiza a 5.2.15
    • Actualiza a 5.3.7
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. CVE-2026-48820

    Media · CVSS 6.3EPSS 0,26%Corrección disponible

    CakePHP: View::element() is missing a path containment check

    CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.2.12, and 5.3.0 through 5.3.5, View::_getElementFileName() does not check that the resolved element path is within the application/plugin view template paths. When element names are created with specifically crafted user-supplied data this weakness can be leveraged to include other PHP files on the server. Patched releases are available in 5.3.6, 5.2.13, 5.1.7, 4.6.4, and 4.5.11.

    cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 4.5.11
    • Actualiza a 4.6.4
    • Actualiza a 5.1.7
    • Actualiza a 5.2.13
    • Actualiza a 5.3.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  5. CVE-2026-23643

    Media · CVSS 5.4EPSS 0,28%Corrección disponible

    CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

    CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

    cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 5.2.12
    • Actualiza a 5.3.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. GHSA-xwhj-pqcg-8rcr

    Sin evaluarCorrección disponible

    CakePHP vulnerable to Cross-site Scripting in some development error pages

    CakePHP 3.4 prior to 3.4.14, 3.5 prior to 3.5.17, and 3.6 prior to 3.6.4 contains a cross-site-scripting (XSS) vulnerability in the development only `missing route` and `duplicate named route` error pages.

    cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 3.4.14
    • Actualiza a 3.5.17
    • Actualiza a 3.6.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. GHSA-p76f-wr22-4rv6

    Sin evaluarCorrección disponible

    CakePHP vulnerable to Remote File Inclusion through View template name manipulation

    CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation.

    cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 2.0.99
    • Actualiza a 2.1.99
    • Actualiza a 2.2.99
    • Actualiza a 2.3.99
    • Actualiza a 2.4.99
    • Actualiza a 2.5.99
    • Actualiza a 2.6.12
    • Actualiza a 2.7.6
    • Actualiza a 3.0.15
    • Actualiza a 3.1.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  8. GHSA-6hg4-vp5q-47mw

    Sin evaluarCorrección disponible

    CakePHP allows direct access of prefixed controller actions

    Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters.

    cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 2.0.99
    • Actualiza a 2.1.99
    • Actualiza a 2.2.99
    • Actualiza a 2.3.99
    • Actualiza a 2.4.99
    • Actualiza a 2.5.9
    • Actualiza a 2.6.11
    • Actualiza a 2.7.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  9. GHSA-q79m-c546-2g63

    Sin evaluarCorrección disponible

    CakePHP vulnerable to Denial of Service attack through XML payloads

    RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.

    cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 2.0.99
    • Actualiza a 2.1.99
    • Actualiza a 2.2.99
    • Actualiza a 2.3.99
    • Actualiza a 2.4.99
    • Actualiza a 2.5.90
    • Actualiza a 2.6.6
    • Actualiza a 3.0.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  10. GHSA-j9q2-f9q7-jhgq

    Sin evaluarCorrección disponible

    CakePHP SecurityComponent cross form submission issue

    Prior to versions 2.4.8 and 1.3.18, forms secured by SecurityComponent could be submitted to any action without triggering SecurityComponent’s tampering protection. If an application contained multiple POST forms to manipulate the same models, it could be vulnerable to mass assignment issues.

    cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 1.3.18
    • Actualiza a 2.4.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  12. CVE-2023-22727

    Crítica · CVSS 9.8EPSS 0,86%Corrección disponible

    Database Query::offset() and limit() vulnerable to SQL injection in cakephp

    CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.

    cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 4.2.12
    • Actualiza a 4.3.11
    • Actualiza a 4.4.10
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  13. CVE-2020-35239

    Alta · CVSS 8.8EPSS 0,61%Corrección disponible

    CVE-2020-35239

    A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.

    cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 4.0.10
    • Actualiza a 4.1.4
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  16. CVE-2016-4793

    Alta · CVSS 7.5EPSS 5,15%Código de explotación públicoCorrección disponible

    CVE-2016-4793

    The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.

    cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 2.6.13
    • Actualiza a 2.7.11
    • Actualiza a 2.8.2
    • Actualiza a 3.0.17
    • Actualiza a 3.1.12
    • Actualiza a 3.2.5
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  18. CVE-2012-4399

    Alta · CVSS 7.5EPSS 12,09%Código de explotación públicoCorrección disponible

    CVE-2012-4399

    The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.

    cakephp/cakephp cakephp/cakephpPHP
    • Actualiza a 2.1.5
    • Actualiza a 2.2.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  19. CVE-2011-3712

    Sin evaluarEPSS 1,58%Corrección disponible

    CVE-2011-3712

    CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by dispatcher.php and certain other files.

    cakephp/cakephpPHP
    • Actualiza a 1.3.8
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  20. CVE-2010-4335

    Sin evaluarEPSS 55,2%Código de explotación públicoCorrección disponible

    CVE-2010-4335

    The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.

    cakephp/cakephpPHP
    • Actualiza a 1.3.6
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →