GHSA-qh8m-9qxx-53m5
Medium · 5.4CVSS
5.4
EPSS
—
Published
Jan 16, 2026
CISA due date
—
The record
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | cakephp/cakephp | 5.2.10 | 5.2.12 |
| Packagist | cakephp/cakephp | 5.3.0 | 5.3.1 |
| packagist | cakephp/cakephp | 5.2.10 | 5.2.12 |
| packagist | cakephp/cakephp | 5.3.0 | No fix |
| packagist | cakephp/cakephp | 5.3.0 | 5.3.1 |
Related vulnerabilities
- CVE-2026-23643 CakePHP is a rapid development framework for PHP. Same vulnerability
- CVE-2012-4399 The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote… Also affects cakephp/cakephp
- CVE-2010-4335 The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x… Also affects cakephp/cakephp
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79