CVE-2026-23643
Medium · 5.4CVSS
5.4
EPSS
0.3%
Published
Jan 16, 2026
CISA due date
—
The record
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | cakephp/cakephp | 5.2.10 | 5.2.12 |
| Packagist | cakephp/cakephp | 5.3.0 | 5.3.1 |
| packagist | cakephp/cakephp | 5.2.10 | 5.2.12 |
| packagist | cakephp/cakephp | 5.3.0 | No fix |
| packagist | cakephp/cakephp | 5.3.0 | 5.3.1 |
Related vulnerabilities
- GHSA-qh8m-9qxx-53m5 CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting Same vulnerability
- CVE-2012-4399 The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote… Also affects cakephp/cakephp
- CVE-2010-4335 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… Also affects cakephp/cakephp
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79