Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/79340?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/79340?format=api", "purl": "pkg:composer/opencart/opencart@3.0.3%2B6", "type": "composer", "namespace": "opencart", "name": "opencart", "version": "3.0.3+6", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53919?format=api", "vulnerability_id": "VCID-97gn-6w6p-sua7", "summary": "Cross-site Scripting\nOpenCart An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-29471", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65179", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65185", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65166", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65178", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65136", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65189", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-29471" }, { "reference_url": "https://www.exploit-db.com/exploits/49098", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.exploit-db.com/exploits/49098" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/49098.txt", "reference_id": "CVE-2020-29471", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/49098.txt" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29471", "reference_id": "CVE-2020-29471", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29471" }, { "reference_url": "https://github.com/advisories/GHSA-7vrp-3pff-c3j4", "reference_id": "GHSA-7vrp-3pff-c3j4", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7vrp-3pff-c3j4" } ], "fixed_packages": [], "aliases": [ "CVE-2020-29471", "GHSA-7vrp-3pff-c3j4" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-97gn-6w6p-sua7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53915?format=api", "vulnerability_id": "VCID-fum5-rac9-hbfg", "summary": "Cross-site Scripting\nOpenCart This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-29470", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65179", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65185", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65166", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65178", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65136", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00475", "scoring_system": "epss", "scoring_elements": "0.65189", "published_at": "2026-06-06T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-29470" }, { "reference_url": "https://www.exploit-db.com/exploits/49099", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.exploit-db.com/exploits/49099" }, { "reference_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/49099.txt", "reference_id": "CVE-2020-29470", "reference_type": "exploit", "scores": [], "url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/webapps/49099.txt" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29470", "reference_id": "CVE-2020-29470", "reference_type": "", "scores": [ { "value": "4.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29470" }, { "reference_url": "https://github.com/advisories/GHSA-87cv-57p8-j33x", "reference_id": "GHSA-87cv-57p8-j33x", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-87cv-57p8-j33x" } ], "fixed_packages": [], "aliases": [ "CVE-2020-29470", "GHSA-87cv-57p8-j33x" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fum5-rac9-hbfg" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53877?format=api", "vulnerability_id": "VCID-qear-8j5f-j3h9", "summary": "Cross-Site Request Forgery (CSRF)\nCross Site Request Forgery (CSRF) in CART option in OpenCart Ltd. Opencart CMS allows attacker to add cart items via `Add` to cart.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-28838", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00096", "scoring_system": "epss", "scoring_elements": "0.26532", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00096", "scoring_system": "epss", "scoring_elements": "0.26536", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00096", "scoring_system": "epss", "scoring_elements": "0.26584", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00096", "scoring_system": "epss", "scoring_elements": "0.26624", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00096", "scoring_system": "epss", "scoring_elements": "0.26635", "published_at": "2026-06-05T12:55:00Z" }, { "value": "0.00096", "scoring_system": "epss", "scoring_elements": "0.26529", "published_at": "2026-06-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-28838" }, { "reference_url": "https://github.com/opencart/opencart", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/opencart/opencart" }, { "reference_url": "https://www.exploit-db.com/exploits/49228", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.exploit-db.com/exploits/49228" }, { "reference_url": "https://www.opencart.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.opencart.com" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28838", "reference_id": "CVE-2020-28838", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N" }, { "value": "LOW", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28838" }, { "reference_url": "https://github.com/advisories/GHSA-3j6m-m5v5-9785", "reference_id": "GHSA-3j6m-m5v5-9785", "reference_type": "", "scores": [ { "value": "LOW", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3j6m-m5v5-9785" } ], "fixed_packages": [], "aliases": [ "CVE-2020-28838", "GHSA-3j6m-m5v5-9785" ], "risk_score": 1.6, "exploitability": "0.5", "weighted_severity": "3.1", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-qear-8j5f-j3h9" } ], "fixing_vulnerabilities": [], "risk_score": "10.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/opencart/opencart@3.0.3%252B6" }