Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 94
Reset filterssilverstripe/framework's User-Agent header not correctly invalidating user session
silverstripe/framework has Cross-site Scripting vulnerability in page history comparison
silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage
silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL
silverstripe/framework has Cross-site Scripting vulnerability in page name
silverstripe/framework member disclosure in login form
silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`
silverstripe/framework's `Member.Name` is not escaped
silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
silverstripe/framework missing ACL on reports
silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`
silverstripe/framework password encryption salt not updated
silverstripe/framework ReadOnly transformation for formfields exploitable
Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter
Silverstripe Missing CSRF protection in login form
Silverstripe Brute force bypass on default admin
Silverstripe XSS in CMS Edit Page
Silverstripe Hostname, IP and Protocol Spoofing through HTTP Headers
Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter
Silverstripe Missing security check on dev/build/defaults
Silverstripe HtmlEditor embed url sanitisation
Silverstripe Form field validation message XSS vulnerability
Silverstripe framework is vulnerable to XSS in install.php
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.