CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
End of life: 9/9/2026, End of support: 10/15/2023, Latest version: 4.4.18
End of life: 9/9/2026, End of support: 10/15/2023, Latest version: 4.4.18
End of life: 9/9/2026, End of support: 6/7/2022, Latest version: 4.3.11
End of life: 9/9/2026, End of support: 6/7/2022, Latest version: 4.3.11
End of life: 12/15/2022, End of support: 12/15/2021, Latest version: 3.10.5
End of life: 12/15/2022, End of support: 12/15/2021, Latest version: 3.10.5
A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
End of life: 10/14/2023, End of support: 10/24/2021, Latest version: 4.2.12
End of life: 10/14/2023, End of support: 10/24/2021, Latest version: 4.2.12
End of support: 12/21/2020, Latest version: 4.1.7
End of support: 12/21/2020, Latest version: 4.1.7
CakePHP before 4.0.6 and 3.10.3 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
End of support: 6/20/2021, Latest version: 3.9.10
End of support: 6/20/2021, Latest version: 3.9.10
End of support: 7/5/2020, Latest version: 4.0.10
End of support: 7/5/2020, Latest version: 4.0.10
End of support: 6/21/2020, Latest version: 3.8.13
End of support: 6/21/2020, Latest version: 3.8.13
An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
End of support: 6/27/2019, Latest version: 3.7.9
End of support: 6/27/2019, Latest version: 3.7.9
End of support: 12/9/2018, Latest version: 3.6.15
End of support: 12/9/2018, Latest version: 3.6.15
End of support: 4/15/2018, Latest version: 3.5.18
End of support: 4/15/2018, Latest version: 3.5.18
End of life: 6/15/2021, End of support: 12/15/2020, Latest version: 2.10.24
End of life: 6/15/2021, End of support: 12/15/2020, Latest version: 2.10.24
End of support: 8/19/2017, Latest version: 3.4.14
End of support: 8/19/2017, Latest version: 3.4.14