Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/81190?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/81190?format=api", "purl": "pkg:composer/topthink/framework@8.0.0", "type": "composer", "namespace": "topthink", "name": "framework", "version": "8.0.0", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55792?format=api", "vulnerability_id": "VCID-7f1c-6yhh-83h6", "summary": "ThinkPHP deserialization vulnerability\nA deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-44902", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.83668", "scoring_system": "epss", "scoring_elements": "0.99306", "published_at": "2026-06-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-44902" }, { "reference_url": "https://github.com/top-think/framework", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/top-think/framework" }, { "reference_url": "http://thinkphp.com", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-09-10T19:36:55Z/" } ], "url": "http://thinkphp.com" }, { "reference_url": "https://github.com/fru1ts/CVE-2024-44902", "reference_id": "CVE-2024-44902", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track*", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2024-09-10T19:36:55Z/" } ], "url": "https://github.com/fru1ts/CVE-2024-44902" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44902", "reference_id": "CVE-2024-44902", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44902" }, { "reference_url": "https://github.com/advisories/GHSA-f4wh-359g-4pq7", "reference_id": "GHSA-f4wh-359g-4pq7", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-f4wh-359g-4pq7" } ], "fixed_packages": [], "aliases": [ "CVE-2024-44902", "GHSA-f4wh-359g-4pq7" ], "risk_score": 10.0, "exploitability": "2.0", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-7f1c-6yhh-83h6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54740?format=api", "vulnerability_id": "VCID-vx17-yg3t-1yfg", "summary": "ThinkPHP allows remote attackers to discover the PHPSESSION cookie\nThinkPHP 8.0.3 allows remote attackers to discover the PHPSESSION cookie because think_exception.tpl (aka the debug error output source code) provides this in an error message for a crafted URI in a GET request.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2024-34467", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00054", "scoring_system": "epss", "scoring_elements": "0.17133", "published_at": "2026-06-06T12:55:00Z" }, { "value": "0.00054", "scoring_system": "epss", "scoring_elements": "0.17039", "published_at": "2026-06-09T12:55:00Z" }, { "value": "0.00054", "scoring_system": "epss", "scoring_elements": "0.17021", "published_at": "2026-06-08T12:55:00Z" }, { "value": "0.00054", "scoring_system": "epss", "scoring_elements": "0.17099", "published_at": "2026-06-07T12:55:00Z" }, { "value": "0.00054", "scoring_system": "epss", "scoring_elements": "0.17138", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2024-34467" }, { "reference_url": "https://github.com/top-think/framework", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/top-think/framework" }, { "reference_url": "https://github.com/top-think/framework/commit/403358cd3e510e2fdab63f951930bdd093314eee", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/top-think/framework/commit/403358cd3e510e2fdab63f951930bdd093314eee" }, { "reference_url": "https://github.com/top-think/framework/commit/57d1950a1844ef8d3098ea290032aeb92e2e32c3", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/top-think/framework/commit/57d1950a1844ef8d3098ea290032aeb92e2e32c3" }, { "reference_url": "https://github.com/top-think/framework/commit/d3904e51e279c3b72ee206192aeccf9b1cffb534", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/top-think/framework/commit/d3904e51e279c3b72ee206192aeccf9b1cffb534" }, { "reference_url": "https://github.com/top-think/framework/issues/2996", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2024-08-16T18:14:34Z/" } ], "url": "https://github.com/top-think/framework/issues/2996" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34467", "reference_id": "CVE-2024-34467", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34467" }, { "reference_url": "https://github.com/advisories/GHSA-969f-v7jv-pgj3", "reference_id": "GHSA-969f-v7jv-pgj3", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-969f-v7jv-pgj3" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/81191?format=api", "purl": "pkg:composer/topthink/framework@8.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-7f1c-6yhh-83h6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/topthink/framework@8.0.4" } ], "aliases": [ "CVE-2024-34467", "GHSA-969f-v7jv-pgj3" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vx17-yg3t-1yfg" } ], "fixing_vulnerabilities": [], "risk_score": "10.0", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:composer/topthink/framework@8.0.0" }