CVE-2006-4067: Cakephp

Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 ("Not Found") error page. NOTE: some of these details are obtained from third party information.

Affected products

• Cakephp Cakephp: up to and including 1.1.6.3264; version 1.0.1.2708 only; version 1.1.3.2967 only; version 1.1.4.3104 only; version 1.1.5.3148 only

Published 2006-08-10. Last modified 2026-06-16.