CVE-2026-23643

Опубликовано: 16 янв. 2026

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

Ссылки

https://bakery.cakephp.org/2026/01/14/cakephp_5212.html
Product
Release Notes
https://github.com/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955f
Patch
https://github.com/cakephp/cakephp/issues/19172
Issue Tracking
https://github.com/cakephp/cakephp/releases/tag/5.2.12
Product
Release Notes
https://github.com/cakephp/cakephp/releases/tag/5.3.1
Product
Release Notes
https://github.com/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m5
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*

Версия от 5.2.10 (включая) до 5.2.12 (исключая)

cpe:2.3:a:cakephp:cakephp:5.3.0:*:*:*:*:*:*:*

EPSS

Процентиль: 5%

0.00021

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

CVE-2026-23643

CVSS3: 5.4

ubuntu

3 месяца назад

CVE-2026-23643

CVSS3: 5.4

debian

3 месяца назад

CakePHP is a rapid development framework for PHP. The PaginatorHelper: ...

GHSA-qh8m-9qxx-53m5

CVSS3: 5.4

github

3 месяца назад

CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting

EPSS

Процентиль: 5%

0.00021

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79