Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
OpenRefine has a path traversal in LoadLanguageCommand
Remote code execution in php-heic-to-jpg
OpenRefine leaks Google API credentials in releases
10Web Social Post Feed <= 1.2.9 - Reflected Cross-Site Scripting
Butterfly's parseJSON, getJSON functions eval malicious input, leading to remote code execution (RCE)
Butterfly has path/URL confusion in resource handling leading to multiple weaknesses
OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
Awesome buttons <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via btn2 Shortcode
OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand
OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal
OpenRefine has a reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)
ai-admin-graphql has a Denial of service vulnerability in SaaS and marketplace setups
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature
baserCMS has a Cross-site Scripting (XSS) Vulnerability in HTTP 400 Bad Request
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts and Contents list Feature
UPS Live Rates and Access Points <= 2.3.12 - Missing Authorization to Plugin API key reset
Apache Syncope: Stored XSS in Console and Enduser
DarkMySite – Advanced Dark Mode Plugin for WordPress <= 1.2.8 - Cross-Site Request Forgery
SEOPress <= 8.1.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.