Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Mass Email To users <= 1.1.4 - Unauthenticated Reflected Cross-Site Scripting via 'entrant'
Emails & Newsletters with Jackmail <= 1.2.22 - Authenticated (Subscriber+) CSV Injecton
AJAX Thumbnail Rebuild <= 1.13 - Missing Authorization
Remote code injection in wwbn/avideo
Chosen Ciphertext Attack in Jose4j
Arbitrary File Read in Admin JS CSS files
Cross-site Scripting (XSS) in DataObject columns grid
Cross-site Scripting (XSS) in DataObject Any Getter grid operator
Path Traversal in Asset "import from server" option
Cross-site Scripting (XSS) in Conditions tab of Pricing Rules
Lightbend Alpakka Kafka logs credentials on debug level
Cross-site Scripting (XSS) in DataObjects QuantityValue Unit Definition
Cross-site Scripting (XSS) in pimcore via DataObject Class date fields
Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field
Cross-site Scripting (XSS) in Document Properties Parameter
SQL Injection in AssetController
Cross-site Scripting (XSS) in Website Settings name field
Cross-site Scripting (XSS) in Admin Login too many attempts notice
Cross-site Scripting (XSS) in DataObject Classification Store
SQL Injection in Admin Translations API
SQL Injection in Translation Export API
SQL Injection in Admin Search Find API
Remote code execution in JFinal CMS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.