Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
WooCommerce Stripe Payment Gateway <= 7.4.0 - Missing Authorization
All Bootstrap Blocks <= 1.3.6 - Cross-Site Request Forgery to Plugin Settings Reset
Securimage-WP <= 3.6.16 - Cross-Site Request Forgery
WordPress Contact Forms by Cimatti <= 1.5.7 - Missing Authorization
WP PDF Generator <= 1.2.2 - Cross-Site Request Forgery to PDF Settings Update
Zephyr Project Manager <= 3.3.93 - Cross-Site Request Forgery
MStore API <= 3.9.6 - Cross-Site Request Forgery to Product Limit Update
Improper neutralization of SQL parameter in Postfinance module
tgstation-server cached user logins in legacy server
@keystone-6/core's bundled cuid package known to be insecure
Apache NiFi vulnerable to Code Injection
Apache NiFi vulnerable to Deserialization of Untrusted Data
GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language
progressbar.js vulnerable to Prototype Pollution
crypto-js uses insecure random numbers
WordPress Contact Forms by Cimatti <= 1.5.7 - Cross-Site Request Forgery via _accua_forms_form_edit_action
Front User Submit | Front Editor <= 3.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Forminator <= 1.23.3 - Race Condition to Multiple Poll Voting
ND Shortcodes <= 6.9 - Authenticated (Subscriber+) Local File Inclusion
MStore API <= 3.9.6 - Missing Authorization
WPForms Google Sheet Connector <= 3.4.5 - Reflected Cross-Site Scripting
Protect WP Admin <= 3.8 - Unauthenticated Information Disclosure to Protection Bypass
YaySMTP <= 2.4.5 - Unauthenticated Stored Cross-Site Scripting via Email
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.