Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/71455?format=api",
    "purl": "pkg:composer/getkirby/cms@5.1.4",
    "type": "composer",
    "namespace": "getkirby",
    "name": "cms",
    "version": "5.1.4",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": false,
    "next_non_vulnerable_version": "2.3.3",
    "latest_non_vulnerable_version": "5.2.2",
    "affected_by_vulnerabilities": [],
    "fixing_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/48408?format=api",
            "vulnerability_id": "VCID-naeq-jec3-1bht",
            "summary": "Kirby CMS has cross-site scripting (XSS) in the changes dialog\nThe \"Changes\" dialog in the Panel displays all content models (pages, files, users) with changed content, i.e. with content that has not yet been published. Each changed model is listed with its preview image/icon and its title/name.\n\nAttackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the \"Changes\" dialog. If another authenticated user subsequently opened the dialog in their Panel, the malicious code would be executed.",
            "references": [
                {
                    "reference_url": "https://github.com/getkirby/kirby",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/getkirby/kirby"
                },
                {
                    "reference_url": "https://github.com/getkirby/kirby/releases/tag/5.1.4",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/getkirby/kirby/releases/tag/5.1.4"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65012",
                    "reference_id": "CVE-2025-65012",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65012"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-84hf-8gh5-575j",
                    "reference_id": "GHSA-84hf-8gh5-575j",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-84hf-8gh5-575j"
                },
                {
                    "reference_url": "https://github.com/getkirby/kirby/security/advisories/GHSA-84hf-8gh5-575j",
                    "reference_id": "GHSA-84hf-8gh5-575j",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-84hf-8gh5-575j"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/71455?format=api",
                    "purl": "pkg:composer/getkirby/cms@5.1.4",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/getkirby/cms@5.1.4"
                }
            ],
            "aliases": [
                "CVE-2025-65012",
                "GHSA-84hf-8gh5-575j"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-naeq-jec3-1bht"
        }
    ],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/getkirby/cms@5.1.4"
}