Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/cakephp/cakephp@3.0.0
Typecomposer
Namespacecakephp
Namecakephp
Version3.0.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.10.3
Latest_non_vulnerable_version5.3.1
Affected_by_vulnerabilities
0
url VCID-6x9m-nyfs-a7hq
vulnerability_id VCID-6x9m-nyfs-a7hq
summary 
CakePHP vulnerable to Denial of Service attack through XML payloads
RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.
references
0
reference_url https://bakery.cakephp.org/2015/05/28/cakephp_2_6_6_and_3_0_6_released.html
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2015/05/28/cakephp_2_6_6_and_3_0_6_released.html
1
reference_url https://github.com/cakephp/cakephp
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp
2
reference_url https://github.com/cakephp/cakephp/commit/c186487151356a8d7c6e2cae05f87b9df0e59fbb
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commit/c186487151356a8d7c6e2cae05f87b9df0e59fbb
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-28.yaml
reference_id
reference_type
scores
0
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-28.yaml
4
reference_url https://github.com/advisories/GHSA-q79m-c546-2g63
reference_id GHSA-q79m-c546-2g63
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-q79m-c546-2g63
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.0.6
purl pkg:composer/cakephp/cakephp@3.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-cz9h-hf83-eycy
3
vulnerability VCID-dha1-eyc9-7qff
4
vulnerability VCID-f8wn-raej-7qg4
5
vulnerability VCID-s536-vx42-xbhk
6
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.6
aliases GHSA-q79m-c546-2g63, GMS-2023-71
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-6x9m-nyfs-a7hq
1
url VCID-84hg-51gr-2qhx
vulnerability_id VCID-84hg-51gr-2qhx
summary 
Cross-Site Request Forgery (CSRF)
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
references
0
reference_url http://bakery.cakephp.org/2015/11/29/cakephp_315_released.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://bakery.cakephp.org/2015/11/29/cakephp_315_released.html
1
reference_url http://blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://blog.mindedsecurity.com/2016/01/request-parameter-method-may-lead-to.html
2
reference_url http://karmainsecurity.com/KIS-2016-01
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://karmainsecurity.com/KIS-2016-01
3
reference_url http://packetstormsecurity.com/files/135301/CakePHP-3.2.0-CSRF-Bypass.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://packetstormsecurity.com/files/135301/CakePHP-3.2.0-CSRF-Bypass.html
4
reference_url https://api.first.org/data/v1/epss?cve=CVE-2015-8379
reference_id
reference_type
scores
0
value 0.0006
scoring_system epss
scoring_elements 0.1911
published_at 2026-06-07T12:55:00Z
1
value 0.0006
scoring_system epss
scoring_elements 0.1908
published_at 2026-06-04T12:55:00Z
2
value 0.0006
scoring_system epss
scoring_elements 0.19154
published_at 2026-06-05T12:55:00Z
3
value 0.0006
scoring_system epss
scoring_elements 0.19151
published_at 2026-06-06T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2015-8379
5
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8379
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8379
6
reference_url http://seclists.org/fulldisclosure/2016/Jan/42
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://seclists.org/fulldisclosure/2016/Jan/42
7
reference_url https://github.com/cakephp/cakephp
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp
8
reference_url https://github.com/cakephp/cakephp/commit/0f818a23a876c01429196bf7623e1e94a50230f0
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commit/0f818a23a876c01429196bf7623e1e94a50230f0
9
reference_url http://www.securityfocus.com/archive/1/537317/100/0/threaded
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/archive/1/537317/100/0/threaded
10
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832316
reference_id 832316
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=832316
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2015-8379
reference_id CVE-2015-8379
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2015-8379
12
reference_url https://github.com/advisories/GHSA-556q-h4vr-pgh2
reference_id GHSA-556q-h4vr-pgh2
reference_type
scores
url https://github.com/advisories/GHSA-556q-h4vr-pgh2
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.1.5
purl pkg:composer/cakephp/cakephp@3.1.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-dha1-eyc9-7qff
2
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.5
aliases CVE-2015-8379, GHSA-556q-h4vr-pgh2
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-84hg-51gr-2qhx
2
url VCID-cp8q-ar71-mqdf
vulnerability_id VCID-cp8q-ar71-mqdf
summary 
Cross-Site Request Forgery (CSRF)
CakePHP mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-15400
reference_id
reference_type
scores
0
value 0.00085
scoring_system epss
scoring_elements 0.24725
published_at 2026-06-06T12:55:00Z
1
value 0.00085
scoring_system epss
scoring_elements 0.24669
published_at 2026-06-07T12:55:00Z
2
value 0.00085
scoring_system epss
scoring_elements 0.24735
published_at 2026-06-05T12:55:00Z
3
value 0.00085
scoring_system epss
scoring_elements 0.24635
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-15400
1
reference_url https://bakery.cakephp.org/2020/04/18/cakephp_406_released.html
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2020/04/18/cakephp_406_released.html
2
reference_url https://bakery.cakephp.org/2022/05/08/cakephp_3103_released.html
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2022/05/08/cakephp_3103_released.html
3
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15400
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15400
4
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985673
reference_id 985673
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985673
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-15400
reference_id CVE-2020-15400
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-15400
6
reference_url https://github.com/advisories/GHSA-j33j-fg2g-mcv2
reference_id GHSA-j33j-fg2g-mcv2
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-j33j-fg2g-mcv2
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.10.3
purl pkg:composer/cakephp/cakephp@3.10.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.10.3
1
url pkg:composer/cakephp/cakephp@4.0.6
purl pkg:composer/cakephp/cakephp@4.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xsdu-qsw4-ebaz
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@4.0.6
aliases CVE-2020-15400, GHSA-j33j-fg2g-mcv2
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cp8q-ar71-mqdf
3
url VCID-cyxs-ap7s-a7az
vulnerability_id VCID-cyxs-ap7s-a7az
summary Cross-Site Request Forgery (CSRF) in cakephp/cakephp.
references
0
reference_url https://bakery.cakephp.org/2015/05/07/cakephp_3_0_4_released.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2015/05/07/cakephp_3_0_4_released.html
1
reference_url https://github.com/cakephp/cakephp
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp
2
reference_url https://github.com/cakephp/cakephp/commit/522ed2f1fb49b00001c1ef8815a6feda790d61dd
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commit/522ed2f1fb49b00001c1ef8815a6feda790d61dd
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-07.yaml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-05-07.yaml
4
reference_url https://github.com/advisories/GHSA-829q-v5g8-hhxc
reference_id GHSA-829q-v5g8-hhxc
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-829q-v5g8-hhxc
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.0.4
purl pkg:composer/cakephp/cakephp@3.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6x9m-nyfs-a7hq
1
vulnerability VCID-84hg-51gr-2qhx
2
vulnerability VCID-cp8q-ar71-mqdf
3
vulnerability VCID-cz9h-hf83-eycy
4
vulnerability VCID-dha1-eyc9-7qff
5
vulnerability VCID-f8wn-raej-7qg4
6
vulnerability VCID-s536-vx42-xbhk
7
vulnerability VCID-yps8-ffx6-3fay
8
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.4
aliases GHSA-829q-v5g8-hhxc, GMS-2023-68
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cyxs-ap7s-a7az
4
url VCID-cz9h-hf83-eycy
vulnerability_id VCID-cz9h-hf83-eycy
summary 
CakePHP vulnerable to Remote File Inclusion through View template name manipulation
CakePHP 2.x prior to 2.0.99, 2.1.99, 2.2.99, 2.3.99, 2.4.99, 2.5.99, 2.6.12, and 2.7.6 and 3.x prior to 3.0.15 and 3.1.4 is vulnerable to Remote File Inclusion through View template name manipulation.
references
0
reference_url https://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html
1
reference_url https://github.com/cakephp/cakephp
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp
2
reference_url https://github.com/cakephp/cakephp/commit/5e60cc5d182e6131e3fbdfdf69f49d560c9ff78b
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commit/5e60cc5d182e6131e3fbdfdf69f49d560c9ff78b
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-11-05.yaml
reference_id
reference_type
scores
0
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/2015-11-05.yaml
4
reference_url https://github.com/advisories/GHSA-p76f-wr22-4rv6
reference_id GHSA-p76f-wr22-4rv6
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-p76f-wr22-4rv6
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.0.15
purl pkg:composer/cakephp/cakephp@3.0.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-dha1-eyc9-7qff
3
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.15
1
url pkg:composer/cakephp/cakephp@3.1.4
purl pkg:composer/cakephp/cakephp@3.1.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-dha1-eyc9-7qff
3
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.4
aliases GHSA-p76f-wr22-4rv6, GMS-2023-70
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cz9h-hf83-eycy
5
url VCID-dha1-eyc9-7qff
vulnerability_id VCID-dha1-eyc9-7qff
summary 
Unsafe deserialization in SmtpTransport in CakePHP
An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-11458
reference_id
reference_type
scores
0
value 0.00527
scoring_system epss
scoring_elements 0.67391
published_at 2026-06-04T12:55:00Z
1
value 0.00527
scoring_system epss
scoring_elements 0.67428
published_at 2026-06-07T12:55:00Z
2
value 0.00527
scoring_system epss
scoring_elements 0.67439
published_at 2026-06-06T12:55:00Z
3
value 0.00527
scoring_system epss
scoring_elements 0.67432
published_at 2026-06-05T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-11458
1
reference_url https://bakery.cakephp.org/2019/04/23/cakephp_377_3615_3518_released.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2019/04/23/cakephp_377_3615_3518_released.html
2
reference_url https://github.com/cakephp/cakephp
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp
3
reference_url https://github.com/cakephp/cakephp/commit/1a74e798309192a9895c9cedabd714ceee345f4e
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commit/1a74e798309192a9895c9cedabd714ceee345f4e
4
reference_url https://github.com/cakephp/cakephp/commit/81412fbe2cb88a304dbeeece1955bc0aec98edb1
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commit/81412fbe2cb88a304dbeeece1955bc0aec98edb1
5
reference_url https://github.com/cakephp/cakephp/commit/c25b91bf7c72db43c01b47a634fd02112ff9f1cd
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commit/c25b91bf7c72db43c01b47a634fd02112ff9f1cd
6
reference_url https://github.com/cakephp/cakephp/commits/master
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commits/master
7
reference_url https://github.com/cakephp/cakephp/compare/3.7.6...3.7.7
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/compare/3.7.6...3.7.7
8
reference_url https://github.com/cakephp/cakephp/releases
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/releases
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-11458
reference_id CVE-2019-11458
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-11458
10
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/CVE-2019-11458.yaml
reference_id CVE-2019-11458.YAML
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/CVE-2019-11458.yaml
11
reference_url https://github.com/advisories/GHSA-qhrx-hcm6-pmrw
reference_id GHSA-qhrx-hcm6-pmrw
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-qhrx-hcm6-pmrw
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.5.18
purl pkg:composer/cakephp/cakephp@3.5.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.5.18
1
url pkg:composer/cakephp/cakephp@3.6.15
purl pkg:composer/cakephp/cakephp@3.6.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.6.15
2
url pkg:composer/cakephp/cakephp@3.7.7
purl pkg:composer/cakephp/cakephp@3.7.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.7.7
aliases CVE-2019-11458, GHSA-qhrx-hcm6-pmrw
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-dha1-eyc9-7qff
6
url VCID-f8wn-raej-7qg4
vulnerability_id VCID-f8wn-raej-7qg4
summary 
Improper Input Validation
The `clientIp` function in CakePHP allows remote attackers to spoof their IP via the `CLIENT-IP` HTTP header.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-4793
reference_id
reference_type
scores
0
value 0.08275
scoring_system epss
scoring_elements 0.92389
published_at 2026-06-07T12:55:00Z
1
value 0.08275
scoring_system epss
scoring_elements 0.92394
published_at 2026-06-06T12:55:00Z
2
value 0.08275
scoring_system epss
scoring_elements 0.92398
published_at 2026-06-05T12:55:00Z
3
value 0.08275
scoring_system epss
scoring_elements 0.92385
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-4793
1
reference_url https://bakery.cakephp.org/2016/03/13/cakephp_2613_2711_282_3017_3112_325_released.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2016/03/13/cakephp_2613_2711_282_3017_3112_325_released.html
2
reference_url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4793
reference_id
reference_type
scores
url https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4793
3
reference_url https://github.com/cakephp/cakephp
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp
4
reference_url https://github.com/cakephp/cakephp/commit/908754649f70bab2b1093942e17c9a46a2fcf6c2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commit/908754649f70bab2b1093942e17c9a46a2fcf6c2
5
reference_url https://support.citrix.com/article/CTX236992
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://support.citrix.com/article/CTX236992
6
reference_url https://www.exploit-db.com/exploits/39813
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.exploit-db.com/exploits/39813
7
reference_url http://www.securityfocus.com/bid/95846
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/95846
8
reference_url http://legalhackers.com/advisories/CakePHP-IP-Spoofing-Vulnerability.txt
reference_id CVE-2016-4793
reference_type exploit
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://legalhackers.com/advisories/CakePHP-IP-Spoofing-Vulnerability.txt
9
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/39813.txt
reference_id CVE-2016-4793
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/39813.txt
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-4793
reference_id CVE-2016-4793
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-4793
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.0.17
purl pkg:composer/cakephp/cakephp@3.0.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-dha1-eyc9-7qff
3
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.17
1
url pkg:composer/cakephp/cakephp@3.1.12
purl pkg:composer/cakephp/cakephp@3.1.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-dha1-eyc9-7qff
2
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.12
2
url pkg:composer/cakephp/cakephp@3.2.5
purl pkg:composer/cakephp/cakephp@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-dha1-eyc9-7qff
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.2.5
aliases CVE-2016-4793, GHSA-j8p3-8m69-2hqq
risk_score 10.0
exploitability 2.0
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f8wn-raej-7qg4
7
url VCID-s536-vx42-xbhk
vulnerability_id VCID-s536-vx42-xbhk
summary 
PHP Remote File Inclusion
Remote File Inclusion through View template name manipulation.
references
0
reference_url https://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html
reference_id
reference_type
scores
url https://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.0.15
purl pkg:composer/cakephp/cakephp@3.0.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-dha1-eyc9-7qff
3
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.15
1
url pkg:composer/cakephp/cakephp@3.1.0-RC1
purl pkg:composer/cakephp/cakephp@3.1.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-dha1-eyc9-7qff
3
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.0-RC1
2
url pkg:composer/cakephp/cakephp@3.1.4
purl pkg:composer/cakephp/cakephp@3.1.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-dha1-eyc9-7qff
3
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.4
aliases GMS-2015-64
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-s536-vx42-xbhk
8
url VCID-wg63-y8w2-6qc6
vulnerability_id VCID-wg63-y8w2-6qc6
summary 
Cross-Site Request Forgery (CSRF)
Incorrect CSRF validation in cakephp.
references
0
reference_url https://bakery.cakephp.org/2015/05/07/cakephp_3_0_4_released.html
reference_id
reference_type
scores
url https://bakery.cakephp.org/2015/05/07/cakephp_3_0_4_released.html
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.0.4
purl pkg:composer/cakephp/cakephp@3.0.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-6x9m-nyfs-a7hq
1
vulnerability VCID-84hg-51gr-2qhx
2
vulnerability VCID-cp8q-ar71-mqdf
3
vulnerability VCID-cz9h-hf83-eycy
4
vulnerability VCID-dha1-eyc9-7qff
5
vulnerability VCID-f8wn-raej-7qg4
6
vulnerability VCID-s536-vx42-xbhk
7
vulnerability VCID-yps8-ffx6-3fay
8
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.4
aliases GMS-2015-61
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wg63-y8w2-6qc6
9
url VCID-yps8-ffx6-3fay
vulnerability_id VCID-yps8-ffx6-3fay
summary 
Uncontrolled Resource Consumption
Denial of Service attack through XML payloads
references
0
reference_url https://bakery.cakephp.org/2015/05/28/cakephp_2_6_6_and_3_0_6_released.html
reference_id
reference_type
scores
url https://bakery.cakephp.org/2015/05/28/cakephp_2_6_6_and_3_0_6_released.html
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.0.6
purl pkg:composer/cakephp/cakephp@3.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-cz9h-hf83-eycy
3
vulnerability VCID-dha1-eyc9-7qff
4
vulnerability VCID-f8wn-raej-7qg4
5
vulnerability VCID-s536-vx42-xbhk
6
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.6
aliases GMS-2015-62
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-yps8-ffx6-3fay
10
url VCID-zbjb-pafr-uudq
vulnerability_id VCID-zbjb-pafr-uudq
summary Unsafe view template filenames result in a Remote File Inclusion vulnerability.
references
0
reference_url http://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html
reference_id
reference_type
scores
url http://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.0.15
purl pkg:composer/cakephp/cakephp@3.0.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-dha1-eyc9-7qff
3
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.15
1
url pkg:composer/cakephp/cakephp@3.1.0-RC1
purl pkg:composer/cakephp/cakephp@3.1.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-dha1-eyc9-7qff
3
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.0-RC1
2
url pkg:composer/cakephp/cakephp@3.1.4
purl pkg:composer/cakephp/cakephp@3.1.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-84hg-51gr-2qhx
1
vulnerability VCID-cp8q-ar71-mqdf
2
vulnerability VCID-dha1-eyc9-7qff
3
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.4
aliases GMS-2015-41
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zbjb-pafr-uudq
Fixing_vulnerabilities
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.0