Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 77
Reset filtersPhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file
PHPSpreadsheet Library < 2.3.0 - XXE Injection
Timber <= 1.23.1 - Use of a Vulnerable Dependency
Login by Auth0 <= 4.6.0 - Reflected Cross-Site Scripting via wle
WooCommerce 8.8.0 - 8.9.2 - Reflected Cross-Site Scripting via Order Attribution
SilverStripe framework XML Quadratic Blowup Attack
Timber <= 1.23.0 - Authenticated (Admin+) PHP Object Injection
WP Crontrol <= 1.16.1 - Remote Code Execution
Flarum's logout Route allows open redirects
Amelia 1.2.18 - 1.2.36 - Unauthenticated Sensitive Information Exposure
MainWP <= 4.4.3.3 - Authenticated (Administrator+) SQL Injection
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
WPGraphQL <= 1.14.5 - Authenticated (Editor+) Server-Side Request Forgery
guzzlehttp/psr7 < 1.9.1 & 2.4.5 - Interpretation Conflict
Complianz - GDPR/CCPA Cookie Consent <= 6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
phpCAS authentication library < 1.6.0 - Service Hostname Discovery Exploitation
Awesome Support <= 6.0.7 - Authenticated Stored Cross-Site Scripting
Rank Math SEO <= 1.0.95 - Server-Side Request Forgery
WP Libre Form 2 <= 2.0.8 - Sensitive Information Disclosure
Guzzle <= 6.5.7 and 7.0-7.4.4 - Information Exposure
WooCommerce <= 6.5.1 - Authenticated (Admin+) HTML Injection
Advanced Contact form 7 DB <= 2.0.8 & Import any XML, CSV or Excel File to WordPress <= 3.8.0 - Use of Vulnerable Component (PHPExcel)
WP-Stateless – Google Cloud Storage <= 3.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.