CVE-2026-23643
MEDIUMCakePHP - XSS
Title source: llmDescription
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
References (6)
Scores
CVSS v3
5.4
EPSS
0.0002
EPSS Percentile
5.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (3)
cakephp/cakephp
5.3.0
cakephp/cakephp
5.2.10 - 5.2.12Packagist
cakephp/cakephp
5.2.10 - 5.2.12
Published
Jan 16, 2026
Tracked Since
Feb 18, 2026