Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Payload does not invalidate JWTs after log out
Printeers Print & Ship <= 1.17.0 - Missing Authorization
YayPricing <= 3.5.3 - Missing Authorization
Nifty Backups <= 1.08 - Reflected Cross-Site Scripting
Task Manager <= 3.0.2 - Unauthenticated Local File Inclusion
Blog Designer PRO <= 3.4.8 - Missing Authorization
MultiSite Clone Duplicator <= 1.5.3 - Reflected Cross-Site Scripting
Cookie Notice & Consent <= 1.6.4 - Unauthenticated Stored Cross-Site Scripting
Sunshine Photo Cart <= 3.5.3 - Missing Authorization
PostX <= 4.1.35 - Authenticated (Editor+) Privilege Escalation
Events Addon for Elementor <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets
Valtimo scripting engine can be used to gain access to sensitive data or resources
List Subpages <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
Ultimate Tag Warrior Importer <= 0.2 - Cross-Site Request Forgery
iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter
OSM Map Widget for Elementor <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL
Volto affected by possible DoS by invoking specific URL by anonymous user
FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability
XWiki PDF export jobs store sensitive cookies unencrypted in job statuses
Contao does not properly manage privileges for page and article fields
Contao can disclose sensitive information in the news module
Contao discloses sensitive information in the front end search index
Contao applies improper access control in the back end voters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.