Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A stored cross-site scripting vulnerability in Cachet allows authenticated users to inject malicious code via incident name and message fields. This script executes in the browsers of users viewing the public status page, potentially enabling session cookie theft, unauthorized redirection, and account takeover.
Disabling protected page indexing in Contao without clearing existing index records can expose member-only titles, URLs, and text snippets to anonymous visitors via the site search.
A vulnerability in Contao's registration module allows unauthenticated attackers to repeatedly trigger activation emails to arbitrary addresses. This creates an email flooding risk and discloses whether an email address has a pending registration.
A cross-site request forgery vulnerability in Contao allows attackers to trigger state-changing or destructive backend actions if an authenticated backend user visits a malicious URL.
A path traversal vulnerability in Contao's images controller allows unauthenticated visitors to read image files located outside the document root and verify path existence within the project directory.
An unauthenticated cross-site scripting vulnerability in Contao's comments bundle allows attackers to inject malicious script that executes when a back end user views the Comments module, potentially leading to administrative takeover or code execution.
An access control flaw in Contao allows non-administrator back end users with access to the preview links module to view all preview links, exposing signed preview URLs for unpublished content.
A caching defect in Contao's table access security voter allows low-privileged backend users to bypass module permissions and gain unauthorized read, create, update, and delete access to database tables.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.