Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure
IdeaPush <= 8.71 - Missing Authorization to Board Term Deletion
hull.js Code Injection Vulnerability
AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s
BP Profile Shortcodes Extra <= 2.6.0 - Authenticated (Contributor+) SQL Injection via tab Parameter
jAlbum Bridge <= 2.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via ar Parameter
Quick License Manager – WooCommerce Plugin <= 2.4.17 - Reflected Cross-Site Scripting
ibexa/post-install affected by Breach with Varnish VCL
ibexa/http-cache affected by Breach with Varnish VCL
ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL
Ibexa Admin UI vulnerable to Cross-site Scripting in a field that is used in the Content name pattern
@intlify/shared Prototype Pollution vulnerability
vue-i18n has cross-site scripting vulnerability with prototype pollution
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
veraPDF CLI has potential XXE (XML External Entity Injection) vulnerability
SimpleSAMLphp xml-common XXE vulnerability
Spectra – WordPress Gutenberg Blocks <= 2.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Widget
Spring Framework has Authorization Bypass for Case Sensitive Comparisons
s2Member (Pro) <= 241114 - Unauthenticated Remote Code Execution
Product Labels For Woocommerce <= 1.5.8 - Authenticated (Administrator+) SQL Injection
Arkhe Blocks <= 2.27.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attributes
Pinpoint Booking System <= 2.9.9.5.1 - Authenticated (Subscriber+) SQL Injection
Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.