Cakefoundation Cakephp — known CVE vulnerabilities

Every CVE whose affected-product data names Cakefoundation Cakephp, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2010-4335 — CVSS 7.5 (high): The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to…
• CVE-2012-4399 — CVSS 7.5 (high): The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing…
• CVE-2020-15400 — CVSS 4.3 (medium): CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.