Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/contao/contao@4.6.11
Typecomposer
Namespacecontao
Namecontao
Version4.6.11
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.9.6
Latest_non_vulnerable_version5.6.1
Affected_by_vulnerabilities
0
url VCID-98fv-kpqs-mybc
vulnerability_id VCID-98fv-kpqs-mybc
summary 
Unrestricted Upload of File with Dangerous Type
Contao allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-19745
reference_id
reference_type
scores
0
value 0.00452
scoring_system epss
scoring_elements 0.64064
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-19745
1
reference_url https://contao.org/en/news.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news.html
2
reference_url https://contao.org/en/security-advisories/unrestricted-file-uploads.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://contao.org/en/security-advisories/unrestricted-file-uploads.html
3
reference_url https://github.com/contao/contao
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-19745
reference_id CVE-2019-19745
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-19745
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19745.yaml
reference_id CVE-2019-19745.YAML
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19745.yaml
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19745.yaml
reference_id CVE-2019-19745.YAML
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19745.yaml
7
reference_url https://github.com/advisories/GHSA-wjx8-cgrm-hh8p
reference_id GHSA-wjx8-cgrm-hh8p
reference_type
scores
url https://github.com/advisories/GHSA-wjx8-cgrm-hh8p
8
reference_url https://github.com/contao/contao/security/advisories/GHSA-wjx8-cgrm-hh8p
reference_id GHSA-wjx8-cgrm-hh8p
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/security/advisories/GHSA-wjx8-cgrm-hh8p
fixed_packages
0
url pkg:composer/contao/contao@4.8.6
purl pkg:composer/contao/contao@4.8.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.8.6
aliases CVE-2019-19745, GHSA-wjx8-cgrm-hh8p
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-98fv-kpqs-mybc
1
url VCID-ah8s-8q49-8qbw
vulnerability_id VCID-ah8s-8q49-8qbw
summary 
Incorrect Default Permissions
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-19712
reference_id
reference_type
scores
0
value 0.00133
scoring_system epss
scoring_elements 0.32448
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-19712
1
reference_url https://contao.org/en/news.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news.html
2
reference_url https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html
3
reference_url https://github.com/contao/contao
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-19712
reference_id CVE-2019-19712
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-19712
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19712.yaml
reference_id CVE-2019-19712.YAML
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19712.yaml
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19712.yaml
reference_id CVE-2019-19712.YAML
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19712.yaml
7
reference_url https://github.com/advisories/GHSA-4mvc-qc5w-v5qr
reference_id GHSA-4mvc-qc5w-v5qr
reference_type
scores
url https://github.com/advisories/GHSA-4mvc-qc5w-v5qr
8
reference_url https://github.com/contao/contao/security/advisories/GHSA-4mvc-qc5w-v5qr
reference_id GHSA-4mvc-qc5w-v5qr
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/security/advisories/GHSA-4mvc-qc5w-v5qr
fixed_packages
0
url pkg:composer/contao/contao@4.8.6
purl pkg:composer/contao/contao@4.8.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.8.6
aliases CVE-2019-19712, GHSA-4mvc-qc5w-v5qr
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ah8s-8q49-8qbw
2
url VCID-u6sk-25yd-e7b2
vulnerability_id VCID-u6sk-25yd-e7b2
summary 
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-25768
reference_id
reference_type
scores
0
value 0.0031
scoring_system epss
scoring_elements 0.54463
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-25768
1
reference_url https://community.contao.org/en/forumdisplay.php?4-Announcements
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://community.contao.org/en/forumdisplay.php?4-Announcements
2
reference_url https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html
3
reference_url https://github.com/contao/contao
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-25768
reference_id CVE-2020-25768
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-25768
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2020-25768.yaml
reference_id CVE-2020-25768.YAML
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2020-25768.yaml
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2020-25768.yaml
reference_id CVE-2020-25768.YAML
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2020-25768.yaml
7
reference_url https://github.com/advisories/GHSA-f7wm-x4gw-6m23
reference_id GHSA-f7wm-x4gw-6m23
reference_type
scores
url https://github.com/advisories/GHSA-f7wm-x4gw-6m23
8
reference_url https://github.com/contao/contao/security/advisories/GHSA-f7wm-x4gw-6m23
reference_id GHSA-f7wm-x4gw-6m23
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/security/advisories/GHSA-f7wm-x4gw-6m23
fixed_packages
0
url pkg:composer/contao/contao@4.9.6
purl pkg:composer/contao/contao@4.9.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.9.6
1
url pkg:composer/contao/contao@4.10.0-RC1
purl pkg:composer/contao/contao@4.10.0-RC1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.10.0-RC1
2
url pkg:composer/contao/contao@4.10.1
purl pkg:composer/contao/contao@4.10.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.10.1
aliases CVE-2020-25768, GHSA-f7wm-x4gw-6m23
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u6sk-25yd-e7b2
Fixing_vulnerabilities
0
url VCID-4rrm-u81m-7kdt
vulnerability_id VCID-4rrm-u81m-7kdt
summary 
Direct Request (Forced Browsing)
Contao has Incorrect Access Control.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-20028
reference_id
reference_type
scores
0
value 0.0027
scoring_system epss
scoring_elements 0.5066
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-20028
1
reference_url https://contao.org/en/news.html
reference_id
reference_type
scores
url https://contao.org/en/news.html
2
reference_url https://contao.org/en/news/security-vulnerability-cve-2018-20028.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news/security-vulnerability-cve-2018-20028.html
3
reference_url https://github.com/contao/contao/commit/bbe5fe1d385cd1195670e2d6b972272133443c59
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/commit/bbe5fe1d385cd1195670e2d6b972272133443c59
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-20028
reference_id CVE-2018-20028
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-20028
5
reference_url https://github.com/advisories/GHSA-q99w-j4mj-7hj8
reference_id GHSA-q99w-j4mj-7hj8
reference_type
scores
url https://github.com/advisories/GHSA-q99w-j4mj-7hj8
fixed_packages
0
url pkg:composer/contao/contao@3.5.37
purl pkg:composer/contao/contao@3.5.37
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@3.5.37
1
url pkg:composer/contao/contao@4.4.31
purl pkg:composer/contao/contao@4.4.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98fv-kpqs-mybc
1
vulnerability VCID-ah8s-8q49-8qbw
2
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.4.31
2
url pkg:composer/contao/contao@4.6.11
purl pkg:composer/contao/contao@4.6.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98fv-kpqs-mybc
1
vulnerability VCID-ah8s-8q49-8qbw
2
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.6.11
aliases CVE-2018-20028, GHSA-q99w-j4mj-7hj8
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4rrm-u81m-7kdt
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/contao/contao@4.6.11