Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 388
Reset filtersXXE in PHPSpreadsheet's XLSX reader
XmlScanner bypass leads to XXE
Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI
Orchid Platform has Method Exposure Vulnerability in Modals
Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
Twig has unguarded calls to `__toString()` when nesting an object into an array
Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery when opening XLSX file
Minecraft MOTD Parser's HtmlGenerator vulnerable to XSS
Kimai has an XXE Leading to Local File Read
The FIDO2/Webauthn Support for PHP library allows enumeration of valid usernames
Firefly III has a MFA bypass in oauth flow
Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability
ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select
ZendFramework Cross-site Scripting vector in `Zend_Filter_StripTags`
Zend-Session session validation vulnerability
ZendFramework Information Disclosure and Insufficient Entropy vulnerability
Zendframework session validation vulnerability
ZendFramework Route Parameter Injection Via Query String in `Zend\Mvc`
By-passing Protection of PharStreamWrapper Interceptor
Symfony2 improper IP based access control
Symfony2 security issue when the trust proxy mode is enabled
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.