Vendor

    Cakephp

    25 known vulnerabilities in products by Cakephp, 0 of them actively exploited (CISA KEV).

    Key figures

    25

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    6

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Cakephp
    HighCVE-2016-4793

    CakePHP: security vulnerability

    also in 1 other product

    		7.5
    CriticalCVE-2026-79752

    CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

    		—
    CriticalCVE-2026-77337

    CakePHP: Potential Authentication bypass with CookieAuthenticator

    		—
    HighCVE-2019-11458

    CakePHP: security vulnerability

    		7.5
    CriticalCVE-2026-119418

    CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame()

    		8.1
    HighCVE-2015-8379

    CakePHP: Cross-Site Request Forgery (CSRF)

    		8.8
    CriticalCVE-2026-119419

    CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation

    		8.1
    MediumCVE-2026-59192

    TwigView: Deserialization of Untrusted Data

    		—
    CriticalCVE-2026-77635

    CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver

    		—
    CriticalCVE-2023-22727

    Database Query::offset() and limit() vulnerable to SQL injection in cakephp

    		9.8
    Not ratedCVE-2010-4335

    CakePHP: Code Execution

    also in 1 other product

    		—
    MediumCVE-2026-59191

    TwigView: FileLoader is vulnerable to arbitrary file read

    		—
    MediumCVE-2026-119417

    CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport

    		3.7
    Not ratedCVE-2006-5031

    CakePHP: Path Traversal

    		—
    MediumCVE-2026-119415

    CakePHP through 5.4.3 MIME Header Injection via FormDataPart Content-Type

    		3.7
    HighCVE-2026-77634

    CakePHP: SmtpTransport vulnerable to CRLF header injection

    		—
    MediumCVE-2026-55590

    CakePHP: Open redirect weakness via backslash bypass

    		6.1
    HighCVE-2020-35239

    CakePHP: Cross-Site Request Forgery (CSRF)

    		8.8
    MediumCVE-2026-119416

    CakePHP through 5.4.3 Cookie Leakage via HTTP Client CookieCollection Domain Matching

    		4.8
    MediumCVE-2026-54614

    DebugKit: MailPreview contains unsafe reflection

    		4.3
    LowCVE-2026-54713

    CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

    		3.7
    MediumCVE-2026-48820

    CakePHP: View::element() is missing a path containment check

    		—
    Not ratedCVE-2011-3712

    CakePHP: Information Disclosure

    		—
    MediumCVE-2026-23643

    CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

    		5.4
    Not ratedCVE-2006-4067

    CakePHP: Cross-Site Scripting (XSS)

    		—

    Products

    Products by Cakephp
    CakePHP200