Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2016-4793

37
FAUCET Score

CVE-2016-4793 describes an IP spoofing vulnerability in CakePHP 3.2.4 and earlier versions, allowing remote attackers to manipulate their IP address via the CLIENT-IP HTTP header. This high-severity vulnerability (CVSS 7.5) has a low attack complexity and can lead to integrity impacts, as it allows attackers to bypass IP-based access controls or logging. While not listed on CISA's KEV catalog, public exploit code exists on ExploitDB, indicating a potential for exploitation. Despite this, there is no evidence of active exploitation, and it has received minimal community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
<= 3.2.4CPE matchmatch criteria
cpe:2.3:a:cakephp:cakephp:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

7.5HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.0

Exploit Intelligence

EPSS Score
5.15%
Probability of exploitation in next 30 days
EPSS Percentile
91.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
ExploitDB: EDB-39813 · May 16, 2016
This CVE's current EPSS score of 0.0515 is in the 85th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

composerpatch availablevia ghsa
Product: cakephp/cakephpFixed in: 2.6.13
composerpatch availablevia ghsa
Product: cakephp/cakephpFixed in: 2.7.11
composerpatch availablevia ghsa
Product: cakephp/cakephpFixed in: 2.8.2
composerpatch availablevia ghsa
Product: cakephp/cakephpFixed in: 3.0.17
composerpatch availablevia ghsa
Product: cakephp/cakephpFixed in: 3.1.12
composerpatch availablevia ghsa
Product: cakephp/cakephpFixed in: 3.2.5

Vendor Advisories (1)

composerGHSA-j8p3-8m69-2hqqhigh

CakePHP allows remote attackers to spoof their IP

May 14, 2022

References

legalhackers.com / advisories/CakePHP-IP-Spoofing-Vulnerability.txt
ExploitThird Party Advisory
bakery.cakephp.org / 2016/03/13/cakephp_2613_2711_282_3017_3112_325_released.html
PatchVendor Advisory
support.citrix.com / article/CTX236992
exploit-db.com / exploits/39813
ExploitThird Party Advisory
securityfocus.com / bid/95846