Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Helix 3 Ajax Plugin - SQL Injection
ProfilePress <= 4.16.17 - Unauthenticated Privilege Escalation
Software Issue Manager <= 5.0.0 - Unauthenticated SQL Injection
WowOptin <= 1.4.37 - Missing Authorization to Unauthenticated Opt-In Deactivation
ProfileGrid <= 5.9.9.6 - Unauthenticated Payment Bypass
ProfileGrid <= 5.9.9.6 - Missing Authorization
CAFEHAUS API <= 1.0.0 - Unauthenticated Privilege Escalation via Password Reset
ProfileGrid <= 5.9.9.6 - Missing Authorization
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
LaunchServer FileServerHandler has an unauthenticated path traversal issue
SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned `Response/InResponseTo` is combined with a signed assertion lacking `SubjectConfirmationData/InResponseTo`
Kimai Favorite Timesheet Add and Remove Endpoints Allows Cross-User Bookmark Manipulation
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
Steeltoe's static JWKS cache shared across schemes and never invalidated
Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
SimpleSAMLphp has Possible DoS via XPath Transform
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.