Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/cakephp/cakephp@2.9.9
purl pkg:composer/cakephp/cakephp@2.9.9
Next non-vulnerable version 3.10.3
Latest non-vulnerable version 5.3.1
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-251n-1k53-57dd
Aliases:
CVE-2015-8379
GHSA-556q-h4vr-pgh2
CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the _method parameter.
3.1.5
Affected by 3 other vulnerabilities.
VCID-74cw-ufme-5yfh
Aliases:
CVE-2020-15400
GHSA-j33j-fg2g-mcv2
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
3.10.3
Affected by 0 other vulnerabilities.
4.0.6
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T18:12:29.246310+00:00 GitLab Importer Affected by VCID-251n-1k53-57dd https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2015-8379.yml 38.6.0
2026-06-12T17:22:15.901278+00:00 GitLab Importer Affected by VCID-74cw-ufme-5yfh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2020-15400.yml 38.6.0