CVE-2026-23643

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23643
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://bakery.cakephp.org/2026/01/14/cakephp_5212.html Product Release Notes
https://github.com/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955f Patch
https://github.com/cakephp/cakephp/issues/19172 Issue Tracking
https://github.com/cakephp/cakephp/releases/tag/5.2.12 Product Release Notes
https://github.com/cakephp/cakephp/releases/tag/5.3.1 Product Release Notes
https://github.com/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m5 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*
cpe:2.3:a:cakephp:cakephp:5.3.0:*:*:*:*:*:*:*
History

23 Feb 2026, 20:51

Type Values Removed Values Added
CPE cpe:2.3:a:cakephp:cakephp:5.3.0:*:*:*:*:*:*:*
cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*
First Time Cakephp
Cakephp cakephp
References () https://bakery.cakephp.org/2026/01/14/cakephp_5212.html - () https://bakery.cakephp.org/2026/01/14/cakephp_5212.html - Product, Release Notes
References () https://github.com/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955f - () https://github.com/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955f - Patch
References () https://github.com/cakephp/cakephp/issues/19172 - () https://github.com/cakephp/cakephp/issues/19172 - Issue Tracking
References () https://github.com/cakephp/cakephp/releases/tag/5.2.12 - () https://github.com/cakephp/cakephp/releases/tag/5.2.12 - Product, Release Notes
References () https://github.com/cakephp/cakephp/releases/tag/5.3.1 - () https://github.com/cakephp/cakephp/releases/tag/5.3.1 - Product, Release Notes
References () https://github.com/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m5 - () https://github.com/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m5 - Vendor Advisory

16 Jan 2026, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-16 21:15

Updated : 2026-02-23 20:51

NVD link : CVE-2026-23643

Mitre link : CVE-2026-23643

CVE.ORG link : CVE-2026-23643

JSON object : View

Products Affected

cakephp

  • cakephp
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')