Vulnerabilities (CVE)

Filtered by vendor Cakephp Subscribe
Total 3 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2023-22727 1 Cakephp 1 Cakephp 2023-01-25 N/A 9.8 CRITICAL
CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
CVE-2016-4793 1 Cakephp 1 Cakephp 2018-10-23 5.0 MEDIUM 7.5 HIGH
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
CVE-2015-8379 1 Cakephp 1 Cakephp 2018-10-09 6.8 MEDIUM 8.8 HIGH
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.