Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
nanoid: custom generators can loop indefinitely when size is zero
nanoid: non-secure generators can loop indefinitely with negative size
veraPDF Parser DoS via PostScript Type 1 Font Programs
veraPDF Parser DoS via PostScript CMap Streams
BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data
veraPDF-validatio: Use of Default `DocumentBuilderFactory` leads to XXE When Processing Untrusted PDFs
veraPDF Validation XXE via Rich Text
FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint
veraPDF Validation XXE via XFA
Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
swagger-typescript-api vulnerable to code injection via unescaped enum string values
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 5.0.10 - Missing Authorization
Ajax Load More <= 8.0.0 - Unauthenticated SQL Injection
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Insecure Direct Object Reference to Unauthenticated Order Receipt Tampering
PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Insecure Direct Object Reference to Unauthenticated Image Attachment Disclosure
Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 - Unauthenticated Remote Code Execution
2FA <= 4.0.0 - Two-Factor Authentication Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.