Cakephp vulnerabilities
We track 7 vulnerabilities in Cakephp products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on October 30, 2026.
Latest Cakephp vulnerabilities
- 8.1 High severity
cakephp: Improper Neutralization of Special Elements used in an SQL Command
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values to StringExpression and IdentifierExpression. Attackers controlling a collation name passed to the constructor or setCol
- 8.1 High severity
cakephp: Improper Neutralization of Special Elements used in an SQL Command
CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated frame offsets and directions to WindowExpression::range() and frame(). Attackers can pass crafted values through applications forwarding
- 9.2 Critical severity
cakephp: Improper Neutralization of Special Elements used in an SQL Command
CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-co
- 9.1 Critical severity
authentication: Authentication Bypass by Spoofing
CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion
- 9.2 Critical severity
cakephp: Improper Neutralization of Special Elements used in an SQL Command
CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBuilder::jsonValue() with PostgresDriver is vulnerable to SQL injection when user-controlled data is supplied to the jsonP
- 8.2 High severity
cakephp: Improper Neutralization of CRLF Sequences
CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release lines, custom mail headers added with Message::setHeaders() or Message::addHeaders() do not have CRLF bytes removed, allowin
- 9.8 Critical severity
cakephp: Improper Neutralization of Special Elements used in an SQL Command
CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.