CVE-2026-23643

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
cakephp	cakephp	>= 5.2.10, < 5.2.12; >= 5.3.0, < 5.3.1

References

https://bakery.cakephp.org/2026/01/14/cakephp_5212.htmlProduct, Release Notes
https://github.com/cakephp/cakephp/commit/c842e7f45d85696e6527d8991dd72f525ced955fPatch
https://github.com/cakephp/cakephp/issues/19172Issue Tracking
https://github.com/cakephp/cakephp/releases/tag/5.2.12Product, Release Notes
https://github.com/cakephp/cakephp/releases/tag/5.3.1Product, Release Notes
https://github.com/cakephp/cakephp/security/advisories/GHSA-qh8m-9qxx-53m5Vendor Advisory

Timeline

Published: Jan 16, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-236447.5esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the s CVE-2026-236456.1SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerab CVE-2026-236466.5OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the abil CVE-2026-236479.8Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authen CVE-2026-236487.8Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions CVE-2026-23657.2The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fluentform_step_form_save_data` AJAX action CVE-2026-236516.7Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.CVE-2026-236529.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker CVE-2026-236536.5Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an autho CVE-2026-236548.8Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a CVE-2026-236556.5Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.CVE-2026-236565.9Insufficient verification of data authenticity in Windows App Installer allows an unauthorized attacker to perform spoofing over a network.