Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,687
webpack-dev-server users' source code may be stolen when they access a malicious web site
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
AngularJS Incomplete Filtering of Special Elements vulnerability
WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion
WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload
billboard.js allows prototype pollution via the function generate
InWave Jobs <= 3.5.8 - Missing Authorization
Team Builder <= 1.5.7 - Missing Authorization
Spice Blocks <= 2.0.7.4 - Unauthenticated Arbitrary File Download
Spare <= 1.7 - Reflected Cross-Site Scripting
Wishlist <= 2.1.0 - Reflected Cross-Site Scripting
MC Woocommerce Wishlist <= 1.9.1 - Reflected Cross-Site Scripting
Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Missing Authorization
Soho Hotel <= 4.2.5 - Reflected Cross-Site Scripting
Backup and Staging by WP Time Capsule <= 1.22.23 - Reflected Cross-Site Scripting
MultiVendorX <= 4.2.22 - Unauthenticated Information Exposure
PressGrid - Frontend Publish Reaction & Multimedia Theme <= 1.3.1 - Unauthenticated PHP Object Injection
elfsight Contact Form widget <= 2.3.1 - Unauthenticated Information Exposure
Hibernate Validator may interpolate user-supplied input in a constraint violation message with Expression Language
Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation
Pekko Management may not properly apply authenticator when Basic Authentication is enabled
Erupt Unrestricted Upload of File with Dangerous Type vulnerability
tar-fs can extract outside the specified dir with a specific tarball
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.