Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,071
Reset filtersMoodle Improper Access Control vulnerability
Concrete CMS vulnerable to stored XSS via the Role Name field
Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature
Concrete CMS vulnerable to stored XSS in file tags and description attributes
Cross-site scripting (XSS) vulnerability in Grav
October CMS Cross-site Scripting vulnerability
Composer code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php
Pimcore Admin Classic Bundle permissions are not getting checked when working with tags
drupal/migrate_tools - SA-CONTRIB-2024-008
CKEditor4 Cross-site Scripting vulnerability caused by incorrect CDATA detection
Sulu HTML Injection via Autocomplete Suggestion
phpMyFAQ vulnerable to stored XSS on attachments filename
phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes
phpMyFAQ User Removal Page Allows Spoofing Of User Details
PHPMailer Local file inclusion
PHPMailer Shell command injection
Bref vulnerable to Body Parsing Inconsistency in Event-Driven Functions
Bref Doesn't Support Multiple Value Headers in ApiGatewayFormatV2
Bref's Uploaded Files Not Deleted in Event-Driven Functions
Statmic CMS vulnerable to account takeover via XSS and password reset link
C5 Firefly III CSV Injection.
drupal/entity_delete_log - SA-CONTRIB-2024-007
Craft CMS Feed-Me
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.