VulnerableCode Package Details - pkg:composer/cakephp/cakephp@3.4.14

Search for packages

Vulnerability	Summary	Fixed by
VCID-74cw-ufme-5yfh Aliases: CVE-2020-15400 GHSA-j33j-fg2g-mcv2	CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.	3.10.3 Affected by 0 other vulnerabilities. 4.0.6 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-9fz7-k62h-eydd Aliases: CVE-2019-11458 GHSA-qhrx-hcm6-pmrw	Unsafe deserialization in SmtpTransport in CakePHP	3.5.18 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.6.15 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 3.7.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-74cw-ufme-5yfh
Aliases:
CVE-2020-15400
GHSA-j33j-fg2g-mcv2

CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.

3.10.3
Affected by 0 other vulnerabilities.

4.0.6
Affected by 1 other vulnerability.

VCID-9fz7-k62h-eydd
Aliases:
CVE-2019-11458
GHSA-qhrx-hcm6-pmrw

Unsafe deserialization in SmtpTransport in CakePHP

3.5.18
Affected by 1 other vulnerability.

3.6.15
Affected by 1 other vulnerability.

3.7.7
Affected by 1 other vulnerability.

Vulnerability	Summary	Aliases
VCID-hx1v-8fp1-x7bg	Cross-site Scripting XSS in some development error pages.	GMS-2018-50
VCID-n6r3-szm9-kke8	CakePHP vulnerable to Cross-site Scripting in some development error pages CakePHP 3.4 prior to 3.4.14, 3.5 prior to 3.5.17, and 3.6 prior to 3.6.4 contains a cross-site-scripting (XSS) vulnerability in the development only `missing route` and `duplicate named route` error pages.	GHSA-xwhj-pqcg-8rcr GMS-2023-72

Vulnerability

Summary

Aliases

VCID-hx1v-8fp1-x7bg

Cross-site Scripting XSS in some development error pages.

GMS-2018-50

VCID-n6r3-szm9-kke8

CakePHP vulnerable to Cross-site Scripting in some development error pages CakePHP 3.4 prior to 3.4.14, 3.5 prior to 3.5.17, and 3.6 prior to 3.6.4 contains a cross-site-scripting (XSS) vulnerability in the development only `missing route` and `duplicate named route` error pages.

GHSA-xwhj-pqcg-8rcr
GMS-2023-72

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-13T06:25:15.772282+00:00	GHSA Importer	Fixing	VCID-n6r3-szm9-kke8	https://github.com/advisories/GHSA-xwhj-pqcg-8rcr	38.6.0
2026-06-12T17:22:16.452036+00:00	GitLab Importer	Affected by	VCID-74cw-ufme-5yfh	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2020-15400.yml	38.6.0
2026-06-12T17:16:07.112895+00:00	GitLab Importer	Affected by	VCID-9fz7-k62h-eydd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2019-11458.yml	38.6.0
2026-06-12T15:45:22.614281+00:00	GitLab Importer	Fixing	VCID-n6r3-szm9-kke8	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/GMS-2023-72.yml	38.6.0
2026-06-12T15:40:31.207953+00:00	GitLab Importer	Fixing	VCID-hx1v-8fp1-x7bg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/GMS-2018-50.yml	38.6.0
2026-06-12T07:57:26.546697+00:00	GithubOSV Importer	Fixing	VCID-n6r3-szm9-kke8	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-xwhj-pqcg-8rcr/GHSA-xwhj-pqcg-8rcr.json	38.6.0