CakePHP vulnerable to Cross-site Scripting in some development error pages

Description

References

• cakephp/cakephp commit 1ea0c87 · WEB
• bakery.cakephp.org/2018/05/20/cakephp_364_3517_3414_released.html · WEB
• FriendsOfPHP/security-advisories · WEB
• cakephp/cakephp · PACKAGE

cakephp/cakephp 的其他漏洞

• CVE-2026-119417低危 3.7CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnera…
• CVE-2026-79752严重 9.2CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder…
• CVE-2026-77635严重 9.2CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBu…
• CVE-2026-48820中危 6.3CakePHP is a rapid development framework for PHP. In versions 4.5.11 and earlier, 4.6.0 through 4.6.3, 5.0.0 through 5.1.6, 5.2.0 through 5.…
• CVE-2026-23643中危 5.4CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via qu…