Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Page Builder: KingComposer < 2.8.2 - Authenticated Stored Cross-Site Scripting
Missing Encryption of Sensitive Data in arrow-kt Arrow
Improper Input Validation in python-dbusmock
WP Database Backup <= 5.1.1 - Cross-Site Scripting
kunena - XSS (Cross Site Scripting)
Improper Certificate Validation in urllib3
Critical severity vulnerability that affects Auth0-WCF-Service-JWT
Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo
Apache Tomcat OS Command Injection vulnerability
CarSpot – Dealership Wordpress Classified Theme < 2.1.7 - Authenticated Stored Cross-Site Scripting
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
Drupal core - SA-CORE-2019-005
Python-saml allows manipulation of SAML data without invalidation of cryptographic signature
SupportCandy – Helpdesk & Support Ticket System <= 2.0.0 - Arbitrary File Upload
Spring Security uses insufficiently random values
Option Tree <= 2.6.0 - PHP Object Injection
MailPoet – emails and newsletters in WordPress <= 3.23.1 - Reflected Cross-Site Scripting via URL parameter
Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit
Improper Neutralization of CRLF Sequences in urllib3 library for Python
WordPress Download Manager <= 2.9.93 - Cross-Site Scripting
WordPress Core < 5.1.1 - Cross-Site Request Forgery to Cross-Site Scripting via Comments
SQL Injection in sequelize
Advanced Contact form 7 DB <= 1.6.0 - SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.