Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,638
Grid Plus <= 3.3 - Reflected Cross-Site Scripting
Liferay Portal's System, Instance and Site Settings are vulnerable to Open Redirect
Liferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack
Hono has Body Limit Middleware Bypass
Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover
Liferay Portal's selection modal is vulnerable to XSS
The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Authenticated (Administrator+) Arbitrary File Deletion
Liferay Portal's Organization Selector exposes organization data to remote authenticated users
Liferay Portal JSON Web Services Direct Class Invocation Enables Service Access Policy Execution
Fidelo Snippet <= 1.12 - Reflected Cross-Site Scripting
ListingPro < 2.9.10 - Missing Authorization
Multiple Plugins and Themes by inkthemes <= 1.1.8 - Unauthenticated Information Exposure
ListingPro < 2.9.10 - Reflected Cross-Site Scripting
ListingPro < 2.9.10 - Unauthenticated Local File Inclusion
Calendar Plus <= 1.2.4 - Reflected Cross-Site Scripting
Logtik <= 2.3 - Reflected Cross-Site Scripting
Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool
Axios is vulnerable to DoS attack through lack of data size check
Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass
Liferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name
Spotify Embed Creator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Blogroll <= 2.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Embed Google Datastudio <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.