Describe the bug
We currently have php-ampqlib as a composer dependency in our project at version 2.6.3. When running the dependency check, lots of vulnerabilities are erroneously listed against the package.

This is because the CPE assigned is cpe:2.3:a:php:php:2.6.3:*:*:*:*:*:*:* which is for the main PHP library. Which means we end up with hundreds of vulns that aren't even related.

Version of dependency-check used
6.0.3

Log file
currently don't have but can be provided

To Reproduce
Steps to reproduce the behaviour:

1. Require php-ampqlib as a dependency in a composer project
2. Run DependencyCheck on the project

Expected behaviour
Only vulns related to the package should be shown - not those of PHP entirely

Additional context
N/A