Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
XStore < 9.6.1 - Reflected Cross-Site Scripting
Resca <= 3.0.2 - Reflected Cross-Site Scripting
Authorsy – Author Box, Multiple Authors, Guest Authors & Post Rating <= 1.0.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Schema & Structured Data for WP & AMP <= 1.49 - Unauthenticated Stored Cross-Site Scripting
XStore < 9.6 - Missing Authorization
XStore < 9.6.1 - Authenticated (Subscriber+) Local File Inclusion
Zoho Flow <= 2.14.1 - Cross-Site Request Forgery
Ultimate Classified Listings <= 1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Liferay Portal exposes ERC which can lead to exploit the time response attack
Liferay Portal is vulnerable to XSS attack through its search bar portlet
Liferay Portal is vulnerable to XSS attacks via its remote app title field
TinyEnv: Inline comments not stripped properly in .env values
TinyEnv: Missing .env file not required — may cause unexpected behavior
Vite middleware may serve files starting with the same name with the public directory
Vite's `server.fs` settings were not applied to HTML files
Maho is Vulnerable to Authenticated Remote Code Execution via File Upload
Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity
Element Plus Link component (el-link) implements insufficient input validation for the href attribute
Apache DolphinScheduler vulnerable to Alert Script Attack
Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting
Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload
PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.