Medium
ghsa-c4c3-j73v-634r
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,543
Medium
ghsa-pp7q-6j3f-74vj
silverstripe/framework has Cross-site Scripting vulnerability in RedirectorPage
Medium
ghsa-r85g-7jpv-8xrx
silverstripe/framework has Cross-site Scripting vulnerability in CMSSecurity BackURL
Medium
ghsa-hhvj-mcrx-3vcf
silverstripe/framework has Cross-site Scripting vulnerability in page name
Medium
ghsa-g84q-cq55-xwgp
silverstripe/framework member disclosure in login form
Medium
ghsa-468j-6jrc-2rjx
silverstripe/framework vulnerable to Cross-site Scripting In `OptionsetField` and `CheckboxSetField`
Medium
ghsa-r9vp-fp72-xgf7
silverstripe/framework's `Member.Name` is not escaped
Low
ghsa-5r8w-66hq-rc39
silverstripe/framework's pre-existing alc_enc cookies log users in if remember me is disabled
Medium
ghsa-52cx-hpc5-cxwc
silverstripe/framework missing ACL on reports
Medium
ghsa-p5h2-vr99-xm99
silverstripe/framework ChangePasswordForm does not check `Member::canLogIn()`
Low
ghsa-f3wp-xpv2-6vmg
silverstripe/framework password encryption salt not updated
Medium
ghsa-frm9-7pm9-5rgc
SilverStripe comments module includes version of jQuery vulnerable to Cross-site Scripting
Critical
CVE-2024-35630
WP TripAdvisor Review Slider <= 12.6 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2024-3236
Popup Builder <= 1.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-35631
FV Flowplayer Video Player <= 7.5.45.7212 - Reflected Cross-Site Scripting
Medium
CVE-2024-35632
Integration for Contact Form 7 and Constant Contact <= 1.1.5 - Cross-Site Request Forgery
Medium
CVE-2024-4305
Post Grid Gutenberg Blocks and WordPress Blog Plugin – PostX <= 4.0.4 - Authenticated (Contributor+) Stored Cross=Site Scripting
Medium
CVE-2024-35651
WP Flow Plus <= 5.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2024-35629
Easy Digital Downloads – Recent Purchases <= 1.0.2 - Unauthenticated Remote File Inclusion
High
CVE-2024-35634
Woocommerce – Recent Purchases <= 1.0.1 - Authenticated (Admin+) Local File Inclusion
Critical
CVE-2024-6159
Push Notification for Post and BuddyPress <= 1.93 - Unauthenticated SQL Injection
High
CVE-2023-46442
Soot Infinite Loop vulnerability
Medium
CVE-2024-22588
Kwik does not discard unused encryption keys
Low
CVE-2024-5273
Jenkins Report Info Plugin Path Traversal vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.