Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/cakephp/cakephp@3.3.0
purl pkg:composer/cakephp/cakephp@3.3.0
Next non-vulnerable version 3.10.3
Latest non-vulnerable version 5.3.1
Risk
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-74cw-ufme-5yfh
Aliases:
CVE-2020-15400
GHSA-j33j-fg2g-mcv2
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
3.10.3
Affected by 0 other vulnerabilities.
4.0.6
Affected by 1 other vulnerability.
VCID-9fz7-k62h-eydd
Aliases:
CVE-2019-11458
GHSA-qhrx-hcm6-pmrw
Unsafe deserialization in SmtpTransport in CakePHP
3.5.18
Affected by 1 other vulnerability.
3.6.15
Affected by 1 other vulnerability.
3.7.7
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T17:22:16.289773+00:00 GitLab Importer Affected by VCID-74cw-ufme-5yfh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2020-15400.yml 38.6.0
2026-06-12T17:16:06.932633+00:00 GitLab Importer Affected by VCID-9fz7-k62h-eydd https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2019-11458.yml 38.6.0