Sploitus

13 exploited vulnerabilities in Cakephp

Vulnerabilities with publicly known exploits

Vendors
Cakephp, Misp, Git, Packagist, Php, Basercms
With known exploits
13
Affected Cakephp versions
= 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.3.6, 2.3.7, 2.3.8, 2.3.9, 2.3.10, 2.4.0, 2.4.1, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 3.2.4, 1.2.8, 1.3, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.1.7.3363
Affected Cakefoundation Cakephp versions
< 2.1.5, 2.2.1, 1.3.0

Vulnerabilities with exploits

Highest CVSS first — 5 of these already have exploit code on Sploitus

CVE-2023-22727
CVSS 9.8 CRITICAL 2023-01-17FIX AVAILABLE
CVE-2015-8379 1 exploit
CVSS 8.8 HIGH 2016-01-26FIX AVAILABLE
CakePHP 3.2.0 CSRF Bypass
CVE-2026-54360
CVSS 8.4 HIGH 2026-06-12
CVE-2019-11458
CVSS 7.5 HIGH 2019-05-08
CVE-2016-4793 2 exploits
CVSS 7.5 HIGH 2017-01-23FIX AVAILABLE
CakePHP Framework 3.2.4 - IP SpoofingCakePHP Framework 3.2.4 - IP Spoofing
CVE-2012-4399 1 exploit
CVSS 7.5 HIGH 2012-10-09FIX AVAILABLE
CakePHP 2.x < 2.2.0-RC2 - XML External Entity Injection
CVE-2010-4335 3 exploits
CVSS 7.5 HIGH 2011-01-14
CakePHP 1.3.5/1.2.8 - 'Unserialize()' File InclusionCakePHP 1.3.5/1.2.8 - Cache Corruption (Metasploit)
CVE-2026-48820
CVSS 6.3 MEDIUM 2026-06-17FIX AVAILABLE
CVE-2026-55590
CVSS 6.1 MEDIUM 2026-06-17FIX AVAILABLE
CVE-2023-29009
CVSS 6.1 MEDIUM 2023-10-26FIX AVAILABLE
CVE-2026-23643
CVSS 5.4 MEDIUM 2026-01-16FIX AVAILABLE
CVE-2011-3712
CVSS 5.0 MEDIUM 2011-09-23FIX AVAILABLE
CVE-2006-5031 1 exploit
CVSS 5.0 MEDIUM 2006-09-27FIX AVAILABLE
CakePHP 1.1.7.3363 - 'Vendors.php' Directory Traversal