Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Campus Directory <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
WP Easy Contact <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
js-toml Prototype Pollution Vulnerability
Claude Code echo command allowed bypass of user approval prompt for command execution
Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access
The ADOdb sqlite3 driver allows SQL injection
IPX Allows Path Traversal via Prefix Matching Bypass
Use-your-Drive | Google Drive plugin for WordPress <= 3.3.1- Unauthenticated Stored Cross-Site Scripting via File Metadata
Sala <= 1.1.3 - Reflected Cross-Site Scripting
Rosalinda <= 1.2.3 - Unauthenticated Local File Inclusion
Eventer <= 3.11.2.1 - Unauthenticated Arbitrary Shortcode Execution
Shopo <= 1.1.4 - Authenticated (Contributor+) Arbitrary File Upload
Renewal <= 1.2.2 - Unauthenticated Local File Inclusion
Pinevale <= 1.0.14 - Unauthenticated Local File Inclusion
Giardino <= 1.1.10 - Unauthenticated Local File Inclusion
Katelyn <= 1.0.10 - Unauthenticated Local File Inclusion
Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string
Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability
Apache Zeppelin: XSS in the Helium module
JetElements For Elementor <= 2.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Wikipedia Preview <= 1.15.0 - Missing Authorization
Javo Core <= 3.0.0.266 - Unauthenticated Remote Code Execution
JetBlog <= 2.4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.