Vulnerability GHSA-qh8m-9qxx-53m5
Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
9 months ago
January 16, 2026 at 09:00 PM UTC
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
5.2.10 - 5.2.11 and 5.3.0
5.2.10 - 5.2.11 and 5.3.0
Summary
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
Details
Impact
The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation.
Patches
This issue has been fixed in 5.2.12 and 5.3.1
Workarounds
If you are unable to upgrade, you should avoid using Paginator::limitControl() until you can upgrade.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
1 month ago
CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection
2.4.5 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
2.4.5 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-vjqc-q4mp-2rvf
Critical
1 month ago
CakePHP: FunctionsBuilder::jsonValue() vulerable to SQL injection with PostgresDriver
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6 GHSA-fxf7-vhh8-7vpq
5.1.0 - 5.1.9 and 5.2.0 - 5.2.14 and 5.3.0 - 5.3.6 GHSA-fxf7-vhh8-7vpq
High Risk
1 month ago
CakePHP: SmtpTransport vulnerable to CRLF header injection
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-2qh5-382h-3jpc
4.5.0 - 4.5.11 and 4.6.0 - 4.6.4 and 5.0.0 - 5.1.8 and 5.2.0 - 5.2.13 and 5.3.0 - 5.3.6 GHSA-2qh5-382h-3jpc
Medium Risk
4 months ago
CakePHP: View::element() is missing a path containment check
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5 GHSA-wpvj-hjcr-h3p2
2.4.5 - 4.5.10 and 4.6.0 - 4.6.3 and 5.0.0 - 5.1.6 and 5.2.0 - 5.2.12 and 5.3.0 - 5.3.5 GHSA-wpvj-hjcr-h3p2
Medium Risk
3 years ago
CakePHP vulnerable to Cross-site Scripting in some development error pages
3.4.0 - 3.4.13 and 3.5.0 - 3.5.16 and 3.6.0 - 3.6.3 GHSA-xwhj-pqcg-8rcr
3.4.0 - 3.4.13 and 3.5.0 - 3.5.16 and 3.6.0 - 3.6.3 GHSA-xwhj-pqcg-8rcr
Impacted packages
Timeline
Published
9 months ago
January 16, 2026 at 09:00 PM UTC
Fixed (5.3.1)
9 months ago
January 14, 2026 at 05:03 AM UTC
Fixed (5.2.12)
9 months ago
January 15, 2026 at 02:54 AM UTC
Last Modified
9 months ago
February 03, 2026 at 03:11 AM UTC