Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
In ApostropheCMS prior to 4.34.0, a REST endpoint bypasses page and field access controls, allowing editor-level users to view restricted pages and fields if they know the document identifier.
An authorization bypass in the ApostropheCMS page REST API allows unauthenticated visitors and low-privileged contributors to read restricted page content and site structure metadata.
A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.
ApostropheCMS contains a flaw where authenticated users on SQLite or PostgreSQL adapters can delete shared prototype methods via exclusion projections, causing a persistent process-wide denial of service.
A code injection vulnerability in TinaCMS CLI allows arbitrary JavaScript execution during project builds when an unescaped Git branch name is embedded directly into generated client source files.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.