Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Donation Thermometer <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Travelfic Toolkit <= 1.3.3 - Missing Authorization
oik <= 4.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
eRoom <= 1.5.6 - Unauthenticated Information Exposure
Featured Post Creative <= 1.5.5 - Missing Authorization
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation
OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization
Better Auth Passkey Plugin allows passkey deletion through IDOR
OpenSearch is vulnerable to DoS via complex query_string inputs
Contao is vulnerable to cross-site scripting in templates
Contao is vulnerable to remote code execution in template closures
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format
REDAXO CMS is vulnerable to XSS through its module management component
REDAXO CMS is vulnerable to RCE attack through its template management component
body-parser is vulnerable to denial of service when url encoding is used
AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload
CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload
Quick Contact Form <= 8.2.5 - Cross-Site Request Forgery
Hotel Booking Lite <= 5.2.3 - Authenticated (Hotel Worker+) Remote Code Execution
Elementor Website Builder <= 3.33.0 - Missing Authorization
UsersWP <= 1.2.47 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.