VulnerableCode Package Details - pkg:composer/cakephp/cakephp@3.0.6

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:composer/cakephp/cakephp@3.0.6

Essentials
History (9)

purl	pkg:composer/cakephp/cakephp@3.0.6

Next non-vulnerable version	3.10.3
Latest non-vulnerable version	5.3.1
Risk	4.0

Vulnerabilities affecting this package (5)

Vulnerability	Summary	Fixed by
VCID-2ggf-ncwr-tkea Aliases: CVE-2019-11458 GHSA-qhrx-hcm6-pmrw		3.5.18 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.6.15 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.7.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-e42e-y1zv-4yem Aliases: CVE-2016-4793 GHSA-j8p3-8m69-2hqq	Improper Input Validation The `clientIp` function in CakePHP allows remote attackers to spoof their IP via the `CLIENT-IP` HTTP header.	3.0.17 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.1.12 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.2.5 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-efhb-ed55-3fdy Aliases: CVE-2020-15400 GHSA-j33j-fg2g-mcv2		3.10.3 Affected by 0 other vulnerabilities. 4.0.6 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-k87k-gfb3-vbab Aliases: GMS-2015-41	Unsafe view template filenames result in a Remote File Inclusion vulnerability.	3.0.15 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.1.0-RC1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.1.4 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-tyh8-9qqj-tfdt Aliases: GMS-2015-64	PHP Remote File Inclusion Remote File Inclusion through View template name manipulation.	3.0.15 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.1.0-RC1 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 3.1.4 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (2)

Vulnerability	Summary	Aliases
VCID-h378-ktx4-eufw	CakePHP vulnerable to Denial of Service attack through XML payloads RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.	GHSA-q79m-c546-2g63 GMS-2023-71
VCID-suka-xj97-1ya2	Uncontrolled Resource Consumption Denial of Service attack through XML payloads	GMS-2015-62

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-01T05:49:13.205792+00:00	GitLab Importer	Affected by	VCID-efhb-ed55-3fdy	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2020-15400.yml	38.6.0
2026-05-31T21:34:57.610050+00:00	GHSA Importer	Fixing	VCID-h378-ktx4-eufw	https://github.com/advisories/GHSA-q79m-c546-2g63	38.6.0
2026-05-31T11:05:44.956134+00:00	GithubOSV Importer	Fixing	VCID-h378-ktx4-eufw	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-q79m-c546-2g63/GHSA-q79m-c546-2g63.json	38.6.0
2026-05-31T10:01:03.134447+00:00	GitLab Importer	Affected by	VCID-2ggf-ncwr-tkea	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2019-11458.yml	38.6.0
2026-05-31T09:37:45.490247+00:00	GitLab Importer	Affected by	VCID-e42e-y1zv-4yem	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2016-4793.yml	38.6.0
2026-05-31T09:34:35.775722+00:00	GitLab Importer	Affected by	VCID-k87k-gfb3-vbab	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/GMS-2015-41.yml	38.6.0
2026-05-31T09:34:35.509467+00:00	GitLab Importer	Affected by	VCID-tyh8-9qqj-tfdt	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/GMS-2015-64.yml	38.6.0
2026-05-30T20:59:31.709492+00:00	GitLab Importer	Fixing	VCID-h378-ktx4-eufw	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/GMS-2023-71.yml	38.6.0
2026-05-30T20:52:15.183498+00:00	GitLab Importer	Fixing	VCID-suka-xj97-1ya2	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/GMS-2015-62.yml	38.6.0