Search for packages
| purl | pkg:composer/cakephp/cakephp@2.8.0-RC1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-251n-1k53-57dd
Aliases: CVE-2015-8379 GHSA-556q-h4vr-pgh2 |
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter. |
Affected by 3 other vulnerabilities. |
|
VCID-3cx6-dpsf-xkhw
Aliases: CVE-2016-4793 GHSA-j8p3-8m69-2hqq |
The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header. |
Affected by 3 other vulnerabilities. Affected by 4 other vulnerabilities. Affected by 3 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-74cw-ufme-5yfh
Aliases: CVE-2020-15400 GHSA-j33j-fg2g-mcv2 |
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS. |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-06-12T18:12:29.156327+00:00 | GitLab Importer | Affected by | VCID-251n-1k53-57dd | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2015-8379.yml | 38.6.0 |
| 2026-06-12T17:22:15.811363+00:00 | GitLab Importer | Affected by | VCID-74cw-ufme-5yfh | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2020-15400.yml | 38.6.0 |
| 2026-06-12T16:52:17.848848+00:00 | GitLab Importer | Affected by | VCID-3cx6-dpsf-xkhw | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2016-4793.yml | 38.6.0 |