Where
-Infinity
0
Severity
9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1.

First published (updated )
Severity
8.2
CRLF Injection
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowing header injection when user-controlled data is used in message headers. This issue is fixed in versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7.

First published (updated )
Severity
9.2
SQL Injection
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonPath parameter. This issue is fixed in versions 5.1.10, 5.2.15, and 5.3.7.

First published (updated )

Latest version: 5.4.1

First published (updated )
Severity
5.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Impact The getLoginRedirect() method contains a weakness to backslash bypasses allowing redirect targets with attacker controlled hostnames.

Patches 3.3.6 and 4.1.1 contain a fix for this issue.

Workarounds If you are unable to upgrade, you should consider adding application validation to the redirect query string parameter to mitigate this vulnerability.

1 / 2
Source: GitHub
First published (updated )
Severity
5.4
EPSS
0.04%
XSS
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Impact The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.

Patches This issue has been fixed in 5.2.12 and 5.3.1

Workarounds If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.

1 / 2
Source: GitHub
First published (updated )
Support Ends
Jul 20, 2026

End of support: 7/20/2026, Latest version: 5.3.7

First published (updated )
Support Ends
Jan 10, 2026

End of support: 1/10/2026, Latest version: 5.2.15

First published (updated )
EOL
Sep 9, 2026
Support Ends
Sep 9, 2025

End of life: 9/9/2026, End of support: 9/9/2025, Latest version: 4.6.5

First published (updated )
EOL
Sep 9, 2026
Support Ends
Mar 23, 2025

End of life: 9/9/2026, End of support: 3/23/2025, Latest version: 4.5.12

First published (updated )
EOL
Sep 9, 2026
Support Ends
Mar 23, 2025

End of life: 9/9/2026, End of support: 3/23/2025, Latest version: 4.5.12

First published (updated )
EOL
Jul 19, 2026
Support Ends
Mar 30, 2025

End of life: 7/19/2026, End of support: 3/30/2025, Latest version: 5.1.10

First published (updated )
EOL
Jul 19, 2026
Support Ends
Mar 30, 2025

End of life: 7/19/2026, End of support: 3/30/2025, Latest version: 5.1.10

First published (updated )
EOL
Jan 9, 2026
Support Ends
Sep 14, 2024

End of life: 1/9/2026, End of support: 9/14/2024, Latest version: 5.0.11

First published (updated )
EOL
Jan 9, 2026
Support Ends
Sep 14, 2024

End of life: 1/9/2026, End of support: 9/14/2024, Latest version: 5.0.11

First published (updated )
Severity
9.8
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CakePHP is a development framework for PHP web apps. In affected versions the Cake\Database\Query::limit() and Cake\Database\Query::offset() methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.

First published (updated )
EOL
Sep 9, 2026
Support Ends
Oct 15, 2023

End of life: 9/9/2026, End of support: 10/15/2023, Latest version: 4.4.18

First published (updated )
EOL
Sep 9, 2026
Support Ends
Oct 15, 2023

End of life: 9/9/2026, End of support: 10/15/2023, Latest version: 4.4.18

First published (updated )
EOL
Sep 9, 2026
Support Ends
Jun 7, 2022

End of life: 9/9/2026, End of support: 6/7/2022, Latest version: 4.3.11

First published (updated )
EOL
Sep 9, 2026
Support Ends
Jun 7, 2022

End of life: 9/9/2026, End of support: 6/7/2022, Latest version: 4.3.11

First published (updated )
EOL
Dec 15, 2022
Support Ends
Dec 15, 2021

End of life: 12/15/2022, End of support: 12/15/2021, Latest version: 3.10.5

First published (updated )
EOL
Dec 15, 2022
Support Ends
Dec 15, 2021

End of life: 12/15/2022, End of support: 12/15/2021, Latest version: 3.10.5

First published (updated )
Severity
8.8
CSRF
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.

First published (updated )
EOL
Oct 14, 2023
Support Ends
Oct 24, 2021

End of life: 10/14/2023, End of support: 10/24/2021, Latest version: 4.2.12

First published (updated )
EOL
Oct 14, 2023
Support Ends
Oct 24, 2021

End of life: 10/14/2023, End of support: 10/24/2021, Latest version: 4.2.12

First published (updated )
Support Ends
Dec 21, 2020

End of support: 12/21/2020, Latest version: 4.1.7

First published (updated )
Support Ends
Dec 21, 2020

End of support: 12/21/2020, Latest version: 4.1.7

First published (updated )
Support Ends
Jun 20, 2021

End of support: 6/20/2021, Latest version: 3.9.10

First published (updated )
Support Ends
Jun 20, 2021

End of support: 6/20/2021, Latest version: 3.9.10

First published (updated )
Support Ends
Jul 5, 2020

End of support: 7/5/2020, Latest version: 4.0.10

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203