[MEDIUM] CakePHP: View::element() is missing a path containment check

PKSA-wx2k-k564-z67n CVE-2026-48820 GHSA-wpvj-hjcr-h3p2

Affected version: <4.5.11|>=4.6.0,<4.6.4|>=5.0.0,<5.1.7|>=5.2.0,<5.2.13|>=5.3.0,<5.3.6

Reported by:
GitHub

[MEDIUM] CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

PKSA-y889-wbb2-rsdf CVE-2026-23643 GHSA-qh8m-9qxx-53m5

Affected version: =5.3.0|>=5.2.10,<5.2.12

Reported by:
GitHub

[CRITICAL] CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection

PKSA-jbfd-4v7c-qszc CVE-2023-22727 GHSA-6g8q-qfpv-57wp

Affected version: >=4.4.0,<4.4.10|>=4.3.0,<4.3.11|>=4.2.0,<4.2.12

Reported by:
GitHub

[HIGH] CakePHP allows method override parameters to bypass CSRF checks

PKSA-r2cj-nv22-p8zs CVE-2020-35239 GHSA-9pgx-pf36-w46r

Affected version: >=4.1.0,<4.1.4|>=4.0.0,<4.0.10

Reported by:
GitHub

[HIGH] CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code

PKSA-8n57-9p3h-1585 CVE-2010-4335 GHSA-g2vx-8v47-4vhh

Affected version: >=1.2.8,<1.3.6

Reported by:
GitHub

[MEDIUM] CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file

PKSA-sw2c-m9vp-fz11 CVE-2011-3712 GHSA-r7p6-fr3x-r877

Affected version: =1.3.7

Reported by:
GitHub

[HIGH] CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references

PKSA-cj1b-7h6y-vc5q CVE-2012-4399 GHSA-5964-pq8r-4q62

Affected version: >=2.2.0-beta,<2.2.1|>=2.1.0-alpha,<2.1.5

Reported by:
GitHub

[HIGH] CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter

PKSA-hv96-tqmc-t3j9 CVE-2015-8379 GHSA-556q-h4vr-pgh2

Affected version: >=2.0.0-alpha,<3.1.5

Reported by:
GitHub

[HIGH] CakePHP allows remote attackers to spoof their IP

PKSA-22c4-k52d-35hx CVE-2016-4793 GHSA-j8p3-8m69-2hqq

Affected version: >=3.2.0-rc1,<3.2.5|>=3.1.0-beta1,<3.1.12|>=3.0.0-rc1,<3.0.17|>=2.8.0-rc1,<2.8.2|>=2.7.0-rc1,<2.7.11|>=1.2.0,<2.6.13

Reported by:
GitHub

[MEDIUM] CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files

PKSA-pjjv-54cg-q6nz CVE-2006-5031 GHSA-rw73-xmpv-j5x2

Affected version: >=1.0.1.2708,<1.1.8.3544

Reported by:
GitHub

[MEDIUM] Cross-site scripting (XSS) vulnerability in CakePHP

PKSA-y13m-5dm6-fpsk CVE-2006-4067 GHSA-vc29-mvwv-wpcq

Affected version: >=1.0.1.2708,<=1.1.6.3264

Reported by:
GitHub

[MEDIUM] Cross-Site Request Forgery in CakePHP

PKSA-8jvz-y796-qyx9 CVE-2020-15400 GHSA-j33j-fg2g-mcv2

Affected version: <3.10.3|>=4.0.0,<4.0.6

Reported by:
GitHub

[HIGH] Unsafe deserialization in SmtpTransport

PKSA-yzfm-z92t-1mxd CVE-2019-11458 GHSA-qhrx-hcm6-pmrw

Affected version: >=3.0.0,<3.5.18|>=3.6.0,<3.6.15|>=3.7.0,<3.7.7

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] XSS in some development error pages

PKSA-2nr2-9gyw-vyr4 GHSA-xwhj-pqcg-8rcr

Affected version: >=3.4.0,<3.4.14|>=3.5.0,<3.5.17|>=3.6.0,<3.6.4

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Remote File Inclusion through View template name manipulation

PKSA-2hqh-1wcb-3xv1 GHSA-6hg4-vp5q-47mw

Affected version: >=2.0.0,<2.0.99|>=2.1.0,<2.1.99|>=2.2.0,<2.2.99|>=2.3.0,<2.3.99|>=2.4.0,<2.4.99|>=2.5.0,<2.5.99|>=2.6.0,<2.6.12|>=2.7.0,<2.7.6|>=3.0.0,<3.0.15|>=3.1.0,<3.1.4

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Direct access of prefixed controller actions

PKSA-rxqv-21q6-c8p8 GHSA-j9q2-f9q7-jhgq

Affected version: >=2.0.0,<2.0.99|>=2.1.0,<2.1.99|>=2.2.0,<2.2.99|>=2.3.0,<2.3.99|>=2.4.0,<2.4.99|>=2.5.0,<2.5.9|>=2.6.0,<2.6.11|>=2.7.0,<2.7.2

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Denial of Service attack through XML payloads

PKSA-xk7x-9sn9-kdzr GHSA-p76f-wr22-4rv6

Affected version: >=3.0.0,<3.0.6|>=2.0.0,<2.0.99|>=2.1.0,<2.1.99|>=2.2.0,<2.2.99|>=2.3.0,<2.3.99|>=2.4.0,<2.4.99|>=2.5.0,<2.5.90|>=2.6.0,<2.6.6

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Incorrect CSRF validation

PKSA-qs16-tzg5-f7mj GHSA-829q-v5g8-hhxc

Affected version: >=3.0.0,<3.0.4

Reported by:
FriendsOfPHP/security-advisories, GitHub

[HIGH] SecurityComponent cross form submission issue

PKSA-qkmw-z6y6-8rt4 GHSA-q79m-c546-2g63

Affected version: >=2.0.0,<2.4.8|>=1.3.0,<1.3.18

Reported by:
FriendsOfPHP/security-advisories, GitHub