Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/cakephp/cakephp@2.5.0-RC2
Typecomposer
Namespacecakephp
Namecakephp
Version2.5.0-RC2
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version3.10.3
Latest_non_vulnerable_version5.3.1
Affected_by_vulnerabilities
0
url VCID-cp8q-ar71-mqdf
vulnerability_id VCID-cp8q-ar71-mqdf
summary 
Cross-Site Request Forgery (CSRF)
CakePHP mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-15400
reference_id
reference_type
scores
0
value 0.00085
scoring_system epss
scoring_elements 0.24635
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-15400
1
reference_url https://bakery.cakephp.org/2020/04/18/cakephp_406_released.html
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2020/04/18/cakephp_406_released.html
2
reference_url https://bakery.cakephp.org/2022/05/08/cakephp_3103_released.html
reference_id
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2022/05/08/cakephp_3103_released.html
3
reference_url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985673
reference_id 985673
reference_type
scores
url https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985673
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-15400
reference_id CVE-2020-15400
reference_type
scores
0
value 4.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-15400
fixed_packages
0
url pkg:composer/cakephp/cakephp@3.10.3
purl pkg:composer/cakephp/cakephp@3.10.3
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.10.3
1
url pkg:composer/cakephp/cakephp@4.0.6
purl pkg:composer/cakephp/cakephp@4.0.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-xsdu-qsw4-ebaz
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@4.0.6
aliases CVE-2020-15400, GHSA-j33j-fg2g-mcv2
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cp8q-ar71-mqdf
1
url VCID-f8wn-raej-7qg4
vulnerability_id VCID-f8wn-raej-7qg4
summary 
Improper Input Validation
The `clientIp` function in CakePHP allows remote attackers to spoof their IP via the `CLIENT-IP` HTTP header.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2016-4793
reference_id
reference_type
scores
0
value 0.08275
scoring_system epss
scoring_elements 0.92385
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2016-4793
1
reference_url https://bakery.cakephp.org/2016/03/13/cakephp_2613_2711_282_3017_3112_325_released.html
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://bakery.cakephp.org/2016/03/13/cakephp_2613_2711_282_3017_3112_325_released.html
2
reference_url https://github.com/cakephp/cakephp
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp
3
reference_url https://github.com/cakephp/cakephp/commit/908754649f70bab2b1093942e17c9a46a2fcf6c2
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/cakephp/cakephp/commit/908754649f70bab2b1093942e17c9a46a2fcf6c2
4
reference_url https://support.citrix.com/article/CTX236992
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://support.citrix.com/article/CTX236992
5
reference_url https://www.exploit-db.com/exploits/39813
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://www.exploit-db.com/exploits/39813
6
reference_url http://www.securityfocus.com/bid/95846
reference_id
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://www.securityfocus.com/bid/95846
7
reference_url http://legalhackers.com/advisories/CakePHP-IP-Spoofing-Vulnerability.txt
reference_id CVE-2016-4793
reference_type exploit
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url http://legalhackers.com/advisories/CakePHP-IP-Spoofing-Vulnerability.txt
8
reference_url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/39813.txt
reference_id CVE-2016-4793
reference_type exploit
scores
url https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/39813.txt
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2016-4793
reference_id CVE-2016-4793
reference_type
scores
0
value 7.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2016-4793
fixed_packages
0
url pkg:composer/cakephp/cakephp@2.6.13
purl pkg:composer/cakephp/cakephp@2.6.13
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.6.13
1
url pkg:composer/cakephp/cakephp@2.7.11
purl pkg:composer/cakephp/cakephp@2.7.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.7.11
2
url pkg:composer/cakephp/cakephp@2.8.2
purl pkg:composer/cakephp/cakephp@2.8.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.8.2
3
url pkg:composer/cakephp/cakephp@3.0.17
purl pkg:composer/cakephp/cakephp@3.0.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-dha1-eyc9-7qff
2
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.17
4
url pkg:composer/cakephp/cakephp@3.1.12
purl pkg:composer/cakephp/cakephp@3.1.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-dha1-eyc9-7qff
2
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.12
5
url pkg:composer/cakephp/cakephp@3.2.5
purl pkg:composer/cakephp/cakephp@3.2.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-dha1-eyc9-7qff
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.2.5
aliases CVE-2016-4793, GHSA-j8p3-8m69-2hqq
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-f8wn-raej-7qg4
2
url VCID-qzjr-cpgd-uba7
vulnerability_id VCID-qzjr-cpgd-uba7
summary 
Potential direct access to prefixed actions
Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters. If your authorization depends on the presence of the prefix routing key you should upgrade as soon as possible.
references
0
reference_url http://bakery.cakephp.org/2015/08/06/cakephp_2_5_9_2_6_10_2_7_2_released.html
reference_id
reference_type
scores
url http://bakery.cakephp.org/2015/08/06/cakephp_2_5_9_2_6_10_2_7_2_released.html
fixed_packages
0
url pkg:composer/cakephp/cakephp@2.5.9
purl pkg:composer/cakephp/cakephp@2.5.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
2
vulnerability VCID-s536-vx42-xbhk
3
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.5.9
1
url pkg:composer/cakephp/cakephp@2.6.0-RC1
purl pkg:composer/cakephp/cakephp@2.6.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
2
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.6.0-RC1
2
url pkg:composer/cakephp/cakephp@2.6.11
purl pkg:composer/cakephp/cakephp@2.6.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
2
vulnerability VCID-s536-vx42-xbhk
3
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.6.11
3
url pkg:composer/cakephp/cakephp@2.7.0-RC
purl pkg:composer/cakephp/cakephp@2.7.0-RC
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.7.0-RC
4
url pkg:composer/cakephp/cakephp@2.7.2
purl pkg:composer/cakephp/cakephp@2.7.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
2
vulnerability VCID-s536-vx42-xbhk
3
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.7.2
5
url pkg:composer/cakephp/cakephp@3.0.0-RC1
purl pkg:composer/cakephp/cakephp@3.0.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.0-RC1
aliases GMS-2015-17
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-qzjr-cpgd-uba7
3
url VCID-wyxz-rb2r-zfck
vulnerability_id VCID-wyxz-rb2r-zfck
summary 
Unreliable data validation
There's a flow in Validation::compare() and Validation::range() that makes possible to pass validation criteria using crafted data.
references
0
reference_url http://bakery.cakephp.org/2015/08/06/cakephp_2_5_9_2_6_10_2_7_2_released.html
reference_id
reference_type
scores
url http://bakery.cakephp.org/2015/08/06/cakephp_2_5_9_2_6_10_2_7_2_released.html
fixed_packages
0
url pkg:composer/cakephp/cakephp@2.5.9
purl pkg:composer/cakephp/cakephp@2.5.9
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
2
vulnerability VCID-s536-vx42-xbhk
3
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.5.9
1
url pkg:composer/cakephp/cakephp@2.6.0-RC1
purl pkg:composer/cakephp/cakephp@2.6.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
2
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.6.0-RC1
2
url pkg:composer/cakephp/cakephp@2.6.11
purl pkg:composer/cakephp/cakephp@2.6.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
2
vulnerability VCID-s536-vx42-xbhk
3
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.6.11
3
url pkg:composer/cakephp/cakephp@2.7.0-RC
purl pkg:composer/cakephp/cakephp@2.7.0-RC
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.7.0-RC
4
url pkg:composer/cakephp/cakephp@2.7.2
purl pkg:composer/cakephp/cakephp@2.7.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
2
vulnerability VCID-s536-vx42-xbhk
3
vulnerability VCID-zbjb-pafr-uudq
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.7.2
5
url pkg:composer/cakephp/cakephp@3.0.0-RC1
purl pkg:composer/cakephp/cakephp@3.0.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.0-RC1
aliases GMS-2015-18
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-wyxz-rb2r-zfck
4
url VCID-zbjb-pafr-uudq
vulnerability_id VCID-zbjb-pafr-uudq
summary Unsafe view template filenames result in a Remote File Inclusion vulnerability.
references
0
reference_url http://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html
reference_id
reference_type
scores
url http://bakery.cakephp.org/2015/11/05/cakephp_3015_314_2612_276_released.html
fixed_packages
0
url pkg:composer/cakephp/cakephp@2.6.12
purl pkg:composer/cakephp/cakephp@2.6.12
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.6.12
1
url pkg:composer/cakephp/cakephp@2.7.0-RC
purl pkg:composer/cakephp/cakephp@2.7.0-RC
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.7.0-RC
2
url pkg:composer/cakephp/cakephp@2.7.6
purl pkg:composer/cakephp/cakephp@2.7.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.7.6
3
url pkg:composer/cakephp/cakephp@3.0.0-RC1
purl pkg:composer/cakephp/cakephp@3.0.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.0-RC1
4
url pkg:composer/cakephp/cakephp@3.0.15
purl pkg:composer/cakephp/cakephp@3.0.15
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-dha1-eyc9-7qff
2
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.0.15
5
url pkg:composer/cakephp/cakephp@3.1.0-RC1
purl pkg:composer/cakephp/cakephp@3.1.0-RC1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-dha1-eyc9-7qff
2
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.0-RC1
6
url pkg:composer/cakephp/cakephp@3.1.4
purl pkg:composer/cakephp/cakephp@3.1.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-cp8q-ar71-mqdf
1
vulnerability VCID-dha1-eyc9-7qff
2
vulnerability VCID-f8wn-raej-7qg4
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@3.1.4
aliases GMS-2015-41
risk_score null
exploitability 0.5
weighted_severity 0.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zbjb-pafr-uudq
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/cakephp/cakephp@2.5.0-RC2