Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature
Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization
Kimai contains a SameSite cookie vulnerability
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
FiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode
Orejime has executable code in HTML attributes
External Control of File Name or Path in Langflow
Flex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation
Overstock Affiliate Links <= 1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Quran Gateway <= 1.5 - Cross-Site Request Forgery to Settings Update
Responsive and Swipe slider <= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode
Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure
WP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting
Attachments Handler <= 1.1.7 - Reflected Cross-Site Scripting
WP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanup
Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update
Amazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
File Uploader for WooCommerce <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data
F70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download
Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization
Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation
Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data
Twitch Player <= 2.1.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.