CVE-2026-23643 — CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. Th…
Published: 2026-01-16 · CVSS: 5.4 · CVSS 3.1
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7