Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/cakephp/cakephp@3.5.18
purl pkg:composer/cakephp/cakephp@3.5.18
Next non-vulnerable version 3.10.3
Latest non-vulnerable version 5.3.1
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-74cw-ufme-5yfh
Aliases:
CVE-2020-15400
GHSA-j33j-fg2g-mcv2
CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
3.10.3
Affected by 0 other vulnerabilities.
4.0.6
Affected by 1 other vulnerability.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-9fz7-k62h-eydd Unsafe deserialization in SmtpTransport in CakePHP CVE-2019-11458
GHSA-qhrx-hcm6-pmrw

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T17:22:16.537778+00:00 GitLab Importer Affected by VCID-74cw-ufme-5yfh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2020-15400.yml 38.6.0
2026-06-12T17:16:07.199423+00:00 GitLab Importer Fixing VCID-9fz7-k62h-eydd https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/cakephp/cakephp/CVE-2019-11458.yml 38.6.0
2026-06-12T08:11:06.447143+00:00 GithubOSV Importer Fixing VCID-9fz7-k62h-eydd https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/12/GHSA-qhrx-hcm6-pmrw/GHSA-qhrx-hcm6-pmrw.json 38.6.0
2026-06-11T20:25:41.759642+00:00 GHSA Importer Fixing VCID-9fz7-k62h-eydd https://github.com/advisories/GHSA-qhrx-hcm6-pmrw 38.6.0