Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Liferay Portal 7.4.0 and Liferay DXP have a reflected cross-site scripting (XSS) vulnerability
svg-sanitizer Bypasses Attribute Sanitization
Magento Cross-Site Request Forgery (CSRF) vulnerability
Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability
Magento vulnerable to denial of service
Magento vulnerable to path traversal
Magento has incorrect authorization issue that leads to arbitrary file system read
Magento Cross-site Scripting vulnerability
Tutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
Liferay Portal and Liferay DXP have a reflected cross-site scripting vulnerability
Easy restaurant menu manager <= 2.0.2 - Cross-Site Request Forgery to Menu Upload
Bouncy Castle for Java on All (API modules) allows Excessive Allocation
Liferay Portal and Liferay DXP have a Denial Of Service via File Upload (DOS) vulnerability
Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers
HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit
School Management <= 1.93.1 (02-07-2025) - Authenticated (Student+) Arbitrary File Upload
Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion
Membership For WooCommerce <= 2.9.0 - Missing Authorization
WP Voting <= 1.8 - Reflected Cross-Site Scripting
Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection
Frontend Admin by DynamiApps <= 3.28.3 - Authenticated (Subscriber+) SQL Injection
OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.