High
CVE-2021-39131
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2021-37695
Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
Medium
ghsa-cfcv-q4qq-2ph4
CKEditor 4 vulnerabilities in versions <4.16.1
Medium
CVE-2021-39138
parse-server new anonymous user session acts as if it's created with password
High
CVE-2021-37627
Privilege escalation via form generator
Medium
CVE-2021-37626
PHP file inclusion via insert tags
Medium
CVE-2021-32809
Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality
High
CVE-2021-32808
Widget feature vulnerability allowing to execute JavaScript code using undo functionality
High
CVE-2021-39371
XML External Entity Injection in PyWPS
Medium
CVE-2021-24665
WP Video Lightbox <= 1.9.2 - Contributor+ Stored Cross-Site Scripting
Medium
CVE-2021-24657
Limit Login Attempts <= 4.0.4 - Stored Cross-Site Scripting
Medium
CVE-2021-24725
Comment Link Remove and Other Comment Tools <= 2.1.4 - Arbitrary Comment Deletion via Cross-Site Request Forgery
Critical
CVE-2021-24638
OMGF <= 4.5.3 - Unauthenticated Path Traversal in REST API
Medium
CVE-2021-24585
Timetable and Event Schedule by MotoPress <= 2.3.19 - Arbitrary User's Hashed Password/Email/Username Disclosure
Medium
CVE-2021-24724
Timetable and Event Schedule by MotoPress <= 2.3.18 - Author+ Stored Cross-Site Scripting
Medium
CVE-2021-24584
Timetable and Event Schedule by MotoPress <= 2.4.1 - Unauthorised Event TimeSlot Update
Medium
CVE-2021-24637
Google Fonts Typography <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via blockType arguments
Medium
CVE-2021-24525
WordPress Shortcodes Plugin — Shortcodes Ultimate <= 5.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2021-24663
Simple Schools Staff Directory <= 1.1 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2021-24583
Timetable and Event Schedule by MotoPress <= 2.4.1 - Unauthorised Event TimeSlot Deletion
Medium
CVE-2021-24667
Gallery Blocks with Lightbox <= 2.2.0 - Authenticated Stored Cross-Site Scripting
Medium
CVE-2021-24613
Post Views Counter <= 1.3.4 - Authenticated Stored Cross-Site Scripting
High
CVE-2021-24639
OMGF <= 4.5.3 - Subscriber+ Arbitrary File/Folder Deletion
High
CVE-2021-24402
WP iCommerce – the first interactive ecommerce for wordpress <= 1.1.1 - Authenticated (Admin+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.