Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
REDAXO CMS is vulnerable to RCE attack through its template management component
body-parser is vulnerable to denial of service when url encoding is used
AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload
CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload
Quick Contact Form <= 8.2.5 - Cross-Site Request Forgery
Hotel Booking Lite <= 5.2.3 - Authenticated (Hotel Worker+) Remote Code Execution
Elementor Website Builder <= 3.33.0 - Missing Authorization
UsersWP <= 1.2.47 - Missing Authorization
Fluent Booking <= 1.9.11 - Missing Authorization
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure
Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages
Chamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export
Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update
Locker Content <= 1.0.0 - Unauthenticated Information Exposure
Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming
Autochat Automatic Conversation <= 1.1.9 - Missing Authorization to Unauthenticated Settings Update
Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery
YouTube Subscribe <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel ID
Just Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.