Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 851
Reset filtersDrupal core uses a vulnerable Third-party library CKEditor
Drupal core Multiple vulnerabilities due to the use of the third-party library Archive_Tar
PrestaShop cross-site scripting via customer contact form in FO, through file upload
Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book
Timber <= 1.23.0 - Authenticated (Admin+) PHP Object Injection
amphp/http-client Denial of Service via HTTP/2 CONTINUATION Frames
AMPHP Denial of Service via HTTP/2 CONTINUATION Frames
drupal/tacjs - SA-CONTRIB-2024-016
Server Side Template Injection (SSTI)
Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency
Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field
Kirby vulnerable to unrestricted file upload of user avatar images
baserCMS Cross-site Scripting vulnerability in Site search Feature
baserCMS OS command injection vulnerability in Installer
baserCMS Cross-site Scripting vulnerability in Content Management
Pixelfed doesn't check OAuth Scopes in API routes, giving elevated permissions
phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes
Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions
Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2
Bref's Uploaded Files Not Deleted in Event-Driven Functions
Host header injection in the password reset
Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts
PrestaShop some attribute not escaped in Validate::isCleanHTML method
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.