Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/56326?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/56326?format=api", "purl": "pkg:composer/shopware/shopware@5.4.3", "type": "composer", "namespace": "shopware", "name": "shopware", "version": "5.4.3", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "5.6.1", "latest_non_vulnerable_version": "5.7.18", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/13716?format=api", "vulnerability_id": "VCID-6cb3-b3qq-juap", "summary": "Deserialization of Untrusted Data\nIn `createInstanceFromNamedArguments` in Shopware, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12799", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.24236", "scoring_system": "epss", "scoring_elements": "0.96183", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12799" }, { "reference_url": "https://github.com/advisories/GHSA-6m27-7cqj-2mxw", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6m27-7cqj-2mxw" }, { "reference_url": "https://github.com/rapid7/metasploit-framework/pull/11828", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rapid7/metasploit-framework/pull/11828" }, { "reference_url": "https://github.com/shopware5/shopware", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/shopware5/shopware" }, { "reference_url": "https://web.archive.org/web/20171112153855/https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20171112153855/https://blog.ripstech.com/2017/shopware-php-object-instantiation-to-blind-xxe" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12799", "reference_id": "CVE-2019-12799", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12799" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57225?format=api", "purl": "pkg:composer/shopware/shopware@5.6.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/shopware@5.6.1" } ], "aliases": [ "CVE-2019-12799", "GHSA-rf8f-hqjv-986p" ], "risk_score": 0.1, "exploitability": "0.5", "weighted_severity": "0.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6cb3-b3qq-juap" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/13737?format=api", "vulnerability_id": "VCID-c3rs-ndfu-c3bq", "summary": "Cross-site Scripting\nShopware has XSS via the Query String to the `backend/Login` or `backend/Login/load/` URI.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12935", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0358", "scoring_system": "epss", "scoring_elements": "0.8794", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-12935" }, { "reference_url": "http://seclists.org/fulldisclosure/2019/Jun/32", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2019/Jun/32" }, { "reference_url": "https://www.netsparker.com/web-applications-advisories/ns-19-004-cross-site-scripting-in-shopware", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.netsparker.com/web-applications-advisories/ns-19-004-cross-site-scripting-in-shopware" }, { "reference_url": "https://www.netsparker.com/web-applications-advisories/ns-19-004-cross-site-scripting-in-shopware/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://www.netsparker.com/web-applications-advisories/ns-19-004-cross-site-scripting-in-shopware/" }, { "reference_url": "https://www.shopware.com/en/changelog/#5-5-8", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.shopware.com/en/changelog/#5-5-8" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12935", "reference_id": "CVE-2019-12935", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12935" }, { "reference_url": "https://github.com/advisories/GHSA-8qxh-hcr9-2379", "reference_id": "GHSA-8qxh-hcr9-2379", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-8qxh-hcr9-2379" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/57244?format=api", "purl": "pkg:composer/shopware/shopware@5.5.8", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6cb3-b3qq-juap" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/shopware@5.5.8" } ], "aliases": [ "CVE-2019-12935", "GHSA-8qxh-hcr9-2379" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-c3rs-ndfu-c3bq" } ], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/13238?format=api", "vulnerability_id": "VCID-vzv3-795x-gfhd", "summary": "Shopware allows SQL Injection by remote authenticated users.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-20713", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0062", "scoring_system": "epss", "scoring_elements": "0.70371", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-20713" }, { "reference_url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2018", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-05-2018" }, { "reference_url": "https://github.com/shopware5/shopware/commit/73cb46727050e28a0d7c2cf8471baaa3eaf2e5e8", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/shopware5/shopware/commit/73cb46727050e28a0d7c2cf8471baaa3eaf2e5e8" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20713", "reference_id": "CVE-2018-20713", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20713" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56326?format=api", "purl": "pkg:composer/shopware/shopware@5.4.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-6cb3-b3qq-juap" }, { "vulnerability": "VCID-c3rs-ndfu-c3bq" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/shopware@5.4.3" } ], "aliases": [ "CVE-2018-20713", "GHSA-42gv-77f4-r3j9" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vzv3-795x-gfhd" } ], "risk_score": "3.1", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/shopware/shopware@5.4.3" }