Filtered by vendor Cakephp Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-22727 1 Cakephp 1 Cakephp 2023-01-25 9.8 Critical
CakePHP is a development framework for PHP web apps. In affected versions the `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data. This issue has been fixed in 4.2.12, 4.3.11, 4.4.10. Users are advised to upgrade. Users unable to upgrade may mitigate this issue by using CakePHP's Pagination library. Manually validating or casting parameters to these methods will also mitigate the issue.
CVE-2016-4793 1 Cakephp 1 Cakephp 2018-10-23 N/A
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header.
CVE-2015-8379 1 Cakephp 1 Cakephp 2018-10-09 N/A
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.