Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS
Mustangproject allows exfiltrating files via XXE attacks
Show Variations as Single Products Woocommerce <= 2.0 - Missing Authorization
Analytics Germanized for Google Analytics <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Pure WC Variation Swatches <= 1.1.7 - Missing Authorization to Unauthenticated Settings Update
Gutenverse <= 3.2.1 - Missing Authorization
Ocean Modal Window <= 2.3.2 - Authenticated (Editor+) Remote Code Execution
Gutenverse Form <= 2.2.0 - Missing Authorization
Virtuaria PagBank / PagSeguro para Woocommerce <= 3.6.3 - Missing Authorization
FluentCommunity <= 2.0.0 - Missing Authorization
Sermon Manager <= 2.30.0 - Missing Authorization
Subscriptions & Memberships for PayPal <= 1.1.7 - Missing Authorization
Easy Form <= 2.7.8 - Missing Authorization
ThingsBoard allows an authenticated user to upload malicious SVG images
Nextend Social Login and Register <= 3.1.21 - Cross-Site Request Forgery to Unlink User Social Login
Apache SkyWalking has a stored XSS vulnerability
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final em
Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements
FireBox <= 3.1.0-free - Authenticated (Contributor+) Stored Cross-Site Scripting
KiviCare <= 3.6.13 - Authenticated (Patient+) SQL Injection
Pool Services <= 3.3 - Unauthenticated Server-Side Request Forgery
Powerlift < 3.2.1 - Missing Authorization
Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.