Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Visit Counter <= 1.0 - Reflected Cross-Site Scripting
ZoloBlocks <= 2.3.2 - Authenticated (Subscriber+) Local File Inclusion
The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter
drupal/ai_seo_link_advisor - SA-CONTRIB-2025-095
Shopware race condition bypasses voucher restrictions
Concrete CMS is vulnerable to Stored XSS from Home Folder on Members Dashboard page
Concrete CMS vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page
oik-privacy-policy <= 1.4.10 - Reflected Cross-Site Scripting
WP Lead Capturing Pages < 2.6 - Missing Authorization to Arbitrary Content Deletion
Porn Videos Embed <= 0.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Post Grid and Gutenberg Blocks <= 2.3.11 - Authenticated (Contributor+) PHP Object Injection
Cost Calculator <= 7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Urna <= 2.5.7 - Unauthenticated Local File Inclusion
Pets <= 1.4.1 - Reflected Cross-Site Scripting
Post Connector <= 1.0.11 - Reflected Cross-Site Scripting
Xinterio <= 4.2 - Unauthenticated Local File Inclusion
Coupon Affiliates <= 6.4.1 - Missing Authorization to Unauthenticated Settings Update
Prevent files / folders access <= 2.6.0 - Authenticated (Subscriber+) Path Traversal
Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks
XWiki exposes passwords and emails stored in fields not named password/email in xml.vm
XWiki leaks password hashes and other accessible password properties
Betheme <= 28.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.