Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,728
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion
Spring Expression language property modification using Spring Cloud Gateway Server WebFlux
Spring Framework annotation detection mechanism may result in improper authorization
Spring Security annotation detection mechanism has authorization bypass
TYPO3 "Form to Database" extension susceptible to Cross-site Scripting
Memberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation
Social Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Openfire has potential identity spoofing issue via unsafe CN parsing
Liferay Stored Cross-site Scripting vulnerability
Liferay has Insecure Default Initialization of Resource issue
Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 13.5 - Unauthenticated Arbitrary File Read
USS Upyun <= 1.5.0 - Cross-Site Request Forgery
Developer Loggers for Simple History <= 0.5 - Authenticated (Admin+) Local File Inclusion
Tactical Popup <= 1.1 - Reflected Cross-Site Scripting
Wide Banner <= 1.0.4 - Missing Authorization
Sydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update
Falang multilanguage <= 1.3.65 - Unauthenticated PHP Object Injection
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
Appointmind <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Cerato <= 2.2.18 - Reflected Cross-Site Scripting
The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content
Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.