CVE-2020-15400
Published Jun 30, 2020CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
Vendor/product archive
cakefoundation / cakephp CVEs
Beta · best-effort3 CVEs tagged to cakefoundation / cakephp — 0 Critical, 2 High, 1 Medium, 0 Low, 0 Unrated.
CVE-2012-4399
Published Oct 9, 2012The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML e…
CVE-2010-4335
Published Jan 14, 2011The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execut…
Showing 1-3 of 3 CVEsPage 1 of 1