Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,404
Reset filtersSilverstripe Framework: Members with no password can be created and bypass custom login forms
XML External Entity (XXE) vulnerability in the XML data handler
Cross-site scripting (XSS) from MIME type auto-detection of uploaded files
Denial of service from unlimited password lengths
drupal/symfony_mailer - SA-CONTRIB-2023-031
Information Disclosure due to Out-of-scope Site Resolution
Pimcore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
grav Server-side Template Injection (SSTI) mitigation bypass
PocketMine-MP vulnerable to server crash using badly formatted sign NBT in BlockActorDataPacket
drupal/tfa - SA-CONTRIB-2023-030
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution
Winter CMS stored XSS through privileged upload of SVG file
Archive_Tar contains Potential RCE if filename starts with phar://
Statamic's Antlers sanitizer cannot effectively sanitize malicious SVG
Magento Open Source allows Cross-Site Scripting (XSS)
Concrete CMS Cross-site Scripting vulnerability
phpMyFAQ Cross-site Scripting
Shopware improper mail validation vulnerability
drupal/mailchimp - SA-CONTRIB-2023-025
drupal/gridstack - SA-CONTRIB-2023-024
WPGraphQL <= 1.14.5 - Authenticated (Editor+) Server-Side Request Forgery
Moodle vulnerable to Server Side Request Forgery
php-imap vulnerable to RCE through a directory traversal vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.