Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.
A client-side prototype pollution vulnerability in ApostropheCMS allows attackers to execute arbitrary JavaScript in the context of an authenticated user session if the victim visits a crafted link, potentially leading to unauthorized data access and administrative compromise.
A lack of attempt throttling on ApostropheCMS's authenticated password-change endpoint allows attackers with an active session to repeatedly guess the current password without lockout or rate limiting, potentially enabling account takeover if the password is weak.
In ApostropheCMS before 4.33.0, the exist-in-locale API allows authenticated low-privilege users to determine whether restricted documents and drafts exist and retrieve localized identifiers without proper document-level authorization checks.
A namespace prefix bypass in sanitize-html allows SVG SMIL animation elements to evade URL sink restrictions, potentially enabling cross-site scripting attacks when SVG elements are allowed.
ApostropheCMS uploadfs with the Azure backend and SAS enabled inadvertently exposes container-level SAS tokens in public attachment links. This allows unauthenticated users to read, overwrite, delete, or list blobs stored in the container.
In @apostrophecms/ai-helper, an authenticated editor can supply a crafted Host header to control the server-side image fetch origin, enabling SSRF against internal hosts and ports.
ApostropheCMS packages interpolate user-supplied CAPTCHA tokens without URL encoding into outbound verification requests. Attackers can inject query parameters to cause verification failures and disrupt protected login and form workflows.
Unauthenticated attackers can stream unbounded multipart request bodies to disk via form submission endpoints in ApostropheCMS, leading to disk space exhaustion and a denial-of-service condition.
ApostropheCMS contains a flaw where authenticated users on SQLite or PostgreSQL adapters can delete shared prototype methods via exclusion projections, causing a persistent process-wide denial of service.
ApostropheCMS exposes single-use session migration tokens in URL query parameters, allowing unauthorized clients that obtain the token to take over user sessions and inherit their privileges.
A denial-of-service vulnerability in Angular Router affects Server-Side Rendering (SSR) on Node.js. Unauthenticated remote attackers can send crafted URLs with empty-path outlet segments to exhaust memory heap or CPU resources, causing worker process crashes and service disruption.
A double path decoding issue in Hono allows crafted requests to bypass middleware mounted on static prefixes, potentially exposing protected static files to unauthenticated attackers.
An open redirect vulnerability in Angular Server-Side Rendering allows unauthenticated attackers to supply crafted dot-segments that bypass URL checks and redirect users off-origin.
The DataStore Table UI in ckan-mcp-server does not validate inbound postMessage origins and targets a wildcard origin for outbound messages. This allows unauthorized frames to spoof content, disrupt handshakes, or observe outbound JSON-RPC messages.
A Qwik server in its default configuration can be crashed with a single unauthenticated HTTP request. Repeated requests can keep every server replica down.
A cache poisoning vulnerability in Nuxt OG Image allows unauthenticated attackers to modify image content delivered to users due to derivable cache keys on dynamic image routes.
An unauthenticated reflected cross-site scripting vulnerability in TanStack Start allows attackers to execute arbitrary JavaScript in the victim's browser context by tricking them into opening a crafted URL. Affected packages should be upgraded to their patched releases.
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment. If an authenticated editor opens a crafted link, an unauthenticated remote attacker can gain arbitrary read and write access to the site's content API as that editor.
A stored cross-site scripting vulnerability in @tinacms/web-components allows attackers with content editing privileges to execute arbitrary scripts via unvalidated link URL schemes in rich-text content.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.