Show filters
3 Total Results
Displaying 1-3 of 3
Sort by:
Attacker Value
Unknown
CVE-2020-15400
Disclosure Date: June 30, 2020 (last updated February 21, 2025)
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
0
Attacker Value
Unknown
CVE-2012-4399
Disclosure Date: October 09, 2012 (last updated February 15, 2024)
The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
0
Attacker Value
Unknown
CVE-2010-4335
Disclosure Date: January 14, 2011 (last updated January 16, 2025)
The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.
0
