← Database

CVE-2026-23643

MEDIUM CVSS: 5.4 Published: 2026-01-16 Modified: 2026-06-17

Description

CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

Affected Platforms

Cakephp Cakephp

Weakness Type

CWE-79

References