Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 851
Reset filtersbaserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts and Contents list Feature
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
Zenario allows authenticated admin users to upload PDF files containing malicious code
October allows an admin account to upload PDF containing malicious JavaScript
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Concrete CMS stored XSS vulnerability in the "Top Navigator Bar" block
Kimai has an XXE Leading to Local File Read
Concrete CMS Stored XSS in the "Next&Previous Nav" block
PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information
FeehiCMS User[avatar] unrestricted upload
Bolt CMS Cross-site Scripting vulnerability
The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames
PrivateBin allows shortening of URLs for other domains
BookStack Incorrect Access Control vulnerability
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
Zip slip in opencart
Cross site scripting in opencart
Cross site scripting in opencart
Cross site scripting in opencart
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.