cakephp

Products

Exploited and recent CVEs

• CVE-2026-119419 High 8.1 CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation 0.4%
• CVE-2026-119418 High 8.1 CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() 0.5%
• CVE-2026-119417 Low 3.7 CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport 0.5%
• CVE-2026-119416 Medium 4.8 CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching 0.2%
• CVE-2026-119415 Low 3.7 CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type 0.4%
• CVE-2026-79752 Critical 9.2 CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection 0.6%
• CVE-2026-54713 Low 3.7 CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions 0.5%
• CVE-2026-54614 Medium 4.3 DebugKit: MailPreview contains unsafe reflection 0.5%
• CVE-2026-77337 Critical 9.1 CakePHP: Potential Authentication bypass with CookieAuthenticator 0.7%
• CVE-2026-77634 High 8.2 CakePHP: SmtpTransport vulnerable to CRLF header injection 0.3%
• CVE-2026-77635 Critical 9.2 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver 0.5%
• CVE-2026-77635 Critical 9.2 CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver 0.5%
• CVE-2026-55590 Medium 5.1 CakePHP: Open redirect weakness via backslash bypass 0.5%
• CVE-2026-48820 Medium 6.3 CakePHP: View::element() is missing a path containment check 0.3%
• CVE-2026-23643 Medium 5.4 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting 0.3%
• CVE-2023-22727 Critical 9.8 Database Query::offset() and limit() vulnerable to SQL injection in cakephp 0.9%