{"schema_version":1,"title":"Cakephp vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 7 vulnerabilities in Cakephp: 0 in the last 7 days and 5 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-79752, was published on 17 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/cakephp","json_url":"https://junglewise.ai/threats/vendors/cakephp.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/cakephp","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":2,"all_time":7,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":1,"last_90_days":5,"last_365_days":6},"latest":[{"cve":"CVE-2026-79752","cvss":4,"epss":0.0062,"slug":"cve-2026-79752-cakephp-functionsbuilder-sql-injection-in-multiple-methods","title":"CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder","severity":"critical","exploited":false,"published_at":"2026-09-17T15:16:51.673+00:00","url":"https://junglewise.ai/threats/cve-2026-79752-cakephp-functionsbuilder-sql-injection-in-multiple-methods"},{"cve":"CVE-2026-54713","cvss":3.7,"epss":0.0046,"slug":"cve-2026-54713-cakephp-queue-incomplete-comparison-in-getuniqueid","title":"CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for","severity":"low","exploited":false,"published_at":"2026-08-27T20:17:49.67+00:00","url":"https://junglewise.ai/threats/cve-2026-54713-cakephp-queue-incomplete-comparison-in-getuniqueid"},{"cve":"CVE-2026-54614","cvss":4.3,"epss":0.0054,"slug":"cve-2026-54614-cakephp-debugkit-mailpreview-unsafe-reflection","title":"DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controlle","severity":"medium","exploited":false,"published_at":"2026-08-26T16:16:28.04+00:00","url":"https://junglewise.ai/threats/cve-2026-54614-cakephp-debugkit-mailpreview-unsafe-reflection"},{"cve":"CVE-2026-77635","cvss":4,"epss":0.0049,"slug":"cve-2026-77635-cakephp-functionsbuilder-jsonvalue-sql-injection-with","title":"CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBu","severity":"critical","exploited":false,"published_at":"2026-08-24T21:17:48.457+00:00","url":"https://junglewise.ai/threats/cve-2026-77635-cakephp-functionsbuilder-jsonvalue-sql-injection-with"},{"cve":"CVE-2026-77634","cvss":4,"epss":0.0054,"slug":"cve-2026-77634-cakephp-smtptransport-crlf-header-injection","title":"CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release line","severity":"high","exploited":false,"published_at":"2026-08-24T21:17:48.307+00:00","url":"https://junglewise.ai/threats/cve-2026-77634-cakephp-smtptransport-crlf-header-injection"},{"cve":"CVE-2026-48820","cvss":4,"epss":0.0037,"slug":"cve-2026-48820-cakephp-path-traversal-and-file-inclusion-in-view-component","title":"CakePHP path traversal and file inclusion in View component","severity":"medium","exploited":false,"published_at":"2026-06-17T22:16:22.11+00:00","url":"https://junglewise.ai/threats/cve-2026-48820-cakephp-path-traversal-and-file-inclusion-in-view-component"},{"cve":"CVE-2016-4793","cvss":7.5,"epss":0.0515,"slug":"cve-2016-4793-cakephp-ip-address-spoofing-in-clientip-function","title":"CakePHP IP address spoofing in clientIp function","severity":"high","exploited":false,"published_at":"2017-01-23T21:59:01.58+00:00","url":"https://junglewise.ai/threats/cve-2016-4793-cakephp-ip-address-spoofing-in-clientip-function"}],"vendor":{"hub":true,"name":"Cakephp","slug":"cakephp","homepage":"https://cakefoundation.org/","description":"The Cake Software Foundation is a non-profit organization that manages the development and promotion of the CakePHP framework.","url":"https://junglewise.ai/threats/vendors/cakephp"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":1,"exploited":0,"vulnerabilities":4},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-79752","cvss":4,"epss":0.0062,"slug":"cve-2026-79752-cakephp-functionsbuilder-sql-injection-in-multiple-methods","title":"CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder","severity":"critical","exploited":false,"published_at":"2026-09-17T15:16:51.673+00:00","url":"https://junglewise.ai/threats/cve-2026-79752-cakephp-functionsbuilder-sql-injection-in-multiple-methods"},{"cve":"CVE-2026-77635","cvss":4,"epss":0.0049,"slug":"cve-2026-77635-cakephp-functionsbuilder-jsonvalue-sql-injection-with","title":"CakePHP is a rapid development framework for PHP. Prior to versions 5.1.10, 5.2.15, and 5.3.7 on their respective release lines, FunctionsBu","severity":"critical","exploited":false,"published_at":"2026-08-24T21:17:48.457+00:00","url":"https://junglewise.ai/threats/cve-2026-77635-cakephp-functionsbuilder-jsonvalue-sql-injection-with"},{"cve":"CVE-2016-4793","cvss":7.5,"epss":0.0515,"slug":"cve-2016-4793-cakephp-ip-address-spoofing-in-clientip-function","title":"CakePHP IP address spoofing in clientIp function","severity":"high","exploited":false,"published_at":"2017-01-23T21:59:01.58+00:00","url":"https://junglewise.ai/threats/cve-2016-4793-cakephp-ip-address-spoofing-in-clientip-function"},{"cve":"CVE-2026-77634","cvss":4,"epss":0.0054,"slug":"cve-2026-77634-cakephp-smtptransport-crlf-header-injection","title":"CakePHP is a rapid development framework for PHP. Prior to versions 4.5.12, 4.6.5, 5.1.8, 5.2.14, and 5.3.7 on their respective release line","severity":"high","exploited":false,"published_at":"2026-08-24T21:17:48.307+00:00","url":"https://junglewise.ai/threats/cve-2026-77634-cakephp-smtptransport-crlf-header-injection"},{"cve":"CVE-2026-54614","cvss":4.3,"epss":0.0054,"slug":"cve-2026-54614-cakephp-debugkit-mailpreview-unsafe-reflection","title":"DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controlle","severity":"medium","exploited":false,"published_at":"2026-08-26T16:16:28.04+00:00","url":"https://junglewise.ai/threats/cve-2026-54614-cakephp-debugkit-mailpreview-unsafe-reflection"},{"cve":"CVE-2026-48820","cvss":4,"epss":0.0037,"slug":"cve-2026-48820-cakephp-path-traversal-and-file-inclusion-in-view-component","title":"CakePHP path traversal and file inclusion in View component","severity":"medium","exploited":false,"published_at":"2026-06-17T22:16:22.11+00:00","url":"https://junglewise.ai/threats/cve-2026-48820-cakephp-path-traversal-and-file-inclusion-in-view-component"},{"cve":"CVE-2026-54713","cvss":3.7,"epss":0.0046,"slug":"cve-2026-54713-cakephp-queue-incomplete-comparison-in-getuniqueid","title":"CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for","severity":"low","exploited":false,"published_at":"2026-08-27T20:17:49.67+00:00","url":"https://junglewise.ai/threats/cve-2026-54713-cakephp-queue-incomplete-comparison-in-getuniqueid"}],"generated_at":"2026-09-27T03:07:00.185062+00:00","technologies":[{"name":"Cakephp","slug":"cakephp","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/cakephp"}]}