Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 94
Reset filtersSilverstripe Framework user enumeration via timing attack on login and password reset forms
Silverstripe Framework has a XSS vulnerability in HTML editor
Reflected Cross Site Scripting (XSS) in error message
Silverstripe Framework has a Reflected Cross Site Scripting (XSS) in error message
Silverstripe Framework has a XSS in form messages
Silverstripe Framework has a XSS via insert media remote file oembed
Silverstripe uses TinyMCE which allows svg files linked in object tags
Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload
silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector
silverstripe/framework has possible denial of service attack vector when flushing
silverstripe/framework may disclose database credentials during connection failure
silverstripe/framework allows upload of dangerous file types
silverstripe/framework vulnerable to member disclosure in login form
silverstripe/framework sends passwords back to browsers under some circumstances
silverstripe/framework uploaded PHP script execution in assets
silverstripe/framework code execution vulnerability
silverstripe/framework BackURL validation bypass with malformed URLs
silverstripe/framework's install.php script discloses sensitive data by pre-populating DB credential forms
silverstripe/framework Privilege Escalation Risk in Member Edit form
silverstripe/framework's URL parameters `isDev` and `isTest` unguarded
silverstripe/framework SQL injection in full text search
silverstripe/framework users inadvertently passing sensitive data to LoginAttempt
silverstripe/framework CSV Excel Macro Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.