Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/aim@3.29.0.dev20250328
Typepypi
Namespace
Nameaim
Version3.29.0.dev20250328
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.0.0.dev6
Latest_non_vulnerable_version4.0.0.dev6
Affected_by_vulnerabilities
0
url VCID-48xs-6auv-93b7
vulnerability_id VCID-48xs-6auv-93b7
summary A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function RestrictedPythonQuery of the file /aim/storage/query.py of the component run_view Object Handler. The manipulation of the argument Abfrage leads to erweiterte Rechte. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-5321
reference_id
reference_type
scores
0
value 0.00376
scoring_system epss
scoring_elements 0.59574
published_at 2026-06-11T12:55:00Z
1
value 0.00376
scoring_system epss
scoring_elements 0.59684
published_at 2026-06-14T12:55:00Z
2
value 0.00376
scoring_system epss
scoring_elements 0.59694
published_at 2026-06-13T12:55:00Z
3
value 0.00376
scoring_system epss
scoring_elements 0.59683
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-5321
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-5321
reference_id
reference_type
scores
0
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
1
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
2
value LOW
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-5321
2
reference_url https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c
reference_id 1fc4747a0ac77a1edc8c32e1d4edc54c
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
3
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
4
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
5
value LOW
scoring_system generic_textual
scoring_elements
6
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-29T15:16:32Z/
url https://gist.github.com/superboy-zjc/1fc4747a0ac77a1edc8c32e1d4edc54c
3
reference_url https://vuldb.com/?ctiid.310492
reference_id ?ctiid.310492
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
3
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
4
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
5
value LOW
scoring_system generic_textual
scoring_elements
6
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-29T15:16:32Z/
url https://vuldb.com/?ctiid.310492
4
reference_url https://github.com/advisories/GHSA-gp5h-f9c5-8355
reference_id GHSA-gp5h-f9c5-8355
reference_type
scores
0
value LOW
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-gp5h-f9c5-8355
5
reference_url https://vuldb.com/?id.310492
reference_id ?id.310492
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
3
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
4
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
5
value LOW
scoring_system generic_textual
scoring_elements
6
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-29T15:16:32Z/
url https://vuldb.com/?id.310492
6
reference_url https://vuldb.com/?submit.580253
reference_id ?submit.580253
reference_type
scores
0
value 6.5
scoring_system cvssv2
scoring_elements AV:N/AC:L/Au:S/C:P/I:P/A:P
1
value 6.3
scoring_system cvssv3
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
2
value 6.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
3
value 2.1
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
4
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
5
value LOW
scoring_system generic_textual
scoring_elements
6
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-05-29T15:16:32Z/
url https://vuldb.com/?submit.580253
fixed_packages
0
url pkg:pypi/aim@3.30.0.dev20250508
purl pkg:pypi/aim@3.30.0.dev20250508
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-rqgm-8gsj-qbeg
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/aim@3.30.0.dev20250508
aliases CVE-2025-5321, GHSA-gp5h-f9c5-8355
risk_score 3.0
exploitability 0.5
weighted_severity 5.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-48xs-6auv-93b7
1
url VCID-rqgm-8gsj-qbeg
vulnerability_id VCID-rqgm-8gsj-qbeg
summary Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reports endpoint, which is interpreted and executed by Pyodide when the report is viewed. No sanitisation or sandbox restrictions prevent JavaScript execution via pyodide.code.run_js().
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-51464
reference_id
reference_type
scores
0
value 0.01878
scoring_system epss
scoring_elements 0.83544
published_at 2026-06-11T12:55:00Z
1
value 0.01878
scoring_system epss
scoring_elements 0.83611
published_at 2026-06-14T12:55:00Z
2
value 0.01878
scoring_system epss
scoring_elements 0.83613
published_at 2026-06-13T12:55:00Z
3
value 0.01878
scoring_system epss
scoring_elements 0.83603
published_at 2026-06-12T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-51464
1
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-51464
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-51464
2
reference_url https://github.com/aimhubio/aim/pull/3333
reference_id 3333
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-07-22T18:15:49Z/
url https://github.com/aimhubio/aim/pull/3333
3
reference_url https://github.com/aimhubio/aim
reference_id aim
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-07-22T18:15:49Z/
url https://github.com/aimhubio/aim
4
reference_url https://www.gecko.security/blog/cve-2025-51464
reference_id cve-2025-51464
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
1
value 5.3
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
2
value MODERATE
scoring_system generic_textual
scoring_elements
3
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-07-22T18:15:49Z/
url https://www.gecko.security/blog/cve-2025-51464
5
reference_url https://github.com/advisories/GHSA-gmvv-rj92-9w35
reference_id GHSA-gmvv-rj92-9w35
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-gmvv-rj92-9w35
fixed_packages
0
url pkg:pypi/aim@4.0.0.dev6
purl pkg:pypi/aim@4.0.0.dev6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/aim@4.0.0.dev6
aliases CVE-2025-51464, GHSA-gmvv-rj92-9w35
risk_score 4.0
exploitability 0.5
weighted_severity 7.9
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-rqgm-8gsj-qbeg
Fixing_vulnerabilities
Risk_score4.0
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/aim@3.29.0.dev20250328