Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,638
@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode
JasperReports has a Java deserialisation vulnerability
Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC
Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields
Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode
WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion
Spring Expression language property modification using Spring Cloud Gateway Server WebFlux
Spring Framework annotation detection mechanism may result in improper authorization
Spring Security annotation detection mechanism has authorization bypass
TYPO3 "Form to Database" extension susceptible to Cross-site Scripting
Memberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation
Social Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Openfire has potential identity spoofing issue via unsafe CN parsing
Liferay Stored Cross-site Scripting vulnerability
Liferay has Insecure Default Initialization of Resource issue
Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 13.5 - Unauthenticated Arbitrary File Read
USS Upyun <= 1.5.0 - Cross-Site Request Forgery
Developer Loggers for Simple History <= 0.5 - Authenticated (Admin+) Local File Inclusion
Tactical Popup <= 1.1 - Reflected Cross-Site Scripting
Wide Banner <= 1.0.4 - Missing Authorization
Sydney <= 2.56 - Missing Authorization to Authenticated (Subscriber+) Limited Theme Options Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.