Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
FacturaScripts is Vulnerable to Reflected XSS
Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Field
Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widget
Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data
WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter
@backstage/plugin-techdocs-node vulnerable to possible Path Traversal in TechDocs Local Generator
H2O has an External Control of File Name or Path vulnerability
Keycloak Server-Side Request Forgery (SSRF) vulnerability
Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes
RaspAP raspap-webgui contains an OS Command Injection vulnerability
Booktics <= 1.0.16 - Missing Authorization
Mikado Core <= 1.6 - Authenticated (Contributor+) Local File Inclusion
Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.7 - Unauthenticated Information Exposure
ThirstyAffiliates <= 3.11.9 - Cross-Site Request Forgery
CMSMasters Content Composer <= 1.4.5 - Authenticated (Contributor+) Local File Inclusion
KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection
LobeHub Vulnerable to Improper Authorization in Presigned Upload
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.8 - Unauthenticated Information Exposure
MyBookTable Bookstore <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Unauthenticated Insecure Direct Object Reference
Gyan Elements <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion
Grand Photography <= 5.7.8 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.