Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:deb/debian/cakephp@1.2.0.7296-rc2-1
purl pkg:deb/debian/cakephp@1.2.0.7296-rc2-1
Next non-vulnerable version 2.8.5-1
Latest non-vulnerable version 2.8.5-1
Risk
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-84hg-51gr-2qhx
Aliases:
CVE-2015-8379
GHSA-556q-h4vr-pgh2
Cross-Site Request Forgery (CSRF) CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
2.8.5-1
Affected by 0 other vulnerabilities.
VCID-f8wn-raej-7qg4
Aliases:
CVE-2016-4793
GHSA-j8p3-8m69-2hqq
Improper Input Validation The `clientIp` function in CakePHP allows remote attackers to spoof their IP via the `CLIENT-IP` HTTP header.
2.8.5-1
Affected by 0 other vulnerabilities.
VCID-xztj-c4bu-fug2
Aliases:
CVE-2010-4335
GHSA-g2vx-8v47-4vhh
The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.
1.3.2-1.1
Affected by 2 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-06T04:03:05.415245+00:00 Debian Oval Importer Affected by VCID-xztj-c4bu-fug2 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0
2026-06-06T00:47:50.483210+00:00 Debian Oval Importer Affected by VCID-f8wn-raej-7qg4 https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0
2026-06-06T00:44:32.234652+00:00 Debian Oval Importer Affected by VCID-84hg-51gr-2qhx https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.6.0