Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A cross-site scripting vulnerability in the Drupal UI Icons module allows attackers with permission to edit content using an authorized text format to execute arbitrary scripts via the CKEditor widget under uncommon situations.
A vulnerability in the FFmpeg Image Toolkit module allows unsanitized file names to be passed to the ffmpeg command-line tool. An attacker must have permission to upload images to exploit this flaw.
A vulnerability in the Drupal Frontend Editing module fails to properly enforce field access permissions when modifying paragraph items, requiring specific editing roles to exploit.
The ABC theme for Drupal does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. An attacker with permissions to create or modify menu link titles could exploit this issue.
A vulnerability in the Dopup module allows unauthorized users to view the titles of private Webforms due to insufficient entity access checks.
A Cross-Site Request Forgery vulnerability in the Drupal frontend_editing module allows attackers to trick an authenticated editor into deleting or reordering paragraphs on a node.
A cross-site scripting vulnerability in the Drupal Block Attributes module allows attackers with specific permissions to inject malicious attributes into blocks due to insufficient sanitization.
The Drupal Media Bulk Upload module does not sufficiently verify permissions to create specific media types when using the bulk upload form. An attacker must have the bulk upload form permission to exploit this vulnerability.
A vulnerability in the Drupal ui_icons module allows insufficiently validated user-provided icon settings to be rendered.
A module in the Sector distribution for Drupal does not sufficiently sanitize media names, potentially allowing users with media creation or editing permissions to conduct cross-site scripting attacks.
A stored cross-site scripting vulnerability in Cachet allows authenticated users to inject malicious code via incident name and message fields. This script executes in the browsers of users viewing the public status page, potentially enabling session cookie theft, unauthorized redirection, and account takeover.
Disabling protected page indexing in Contao without clearing existing index records can expose member-only titles, URLs, and text snippets to anonymous visitors via the site search.
A vulnerability in Contao's registration module allows unauthenticated attackers to repeatedly trigger activation emails to arbitrary addresses. This creates an email flooding risk and discloses whether an email address has a pending registration.
A cross-site request forgery vulnerability in Contao allows attackers to trigger state-changing or destructive backend actions if an authenticated backend user visits a malicious URL.
A path traversal vulnerability in Contao's images controller allows unauthenticated visitors to read image files located outside the document root and verify path existence within the project directory.
An unauthenticated cross-site scripting vulnerability in Contao's comments bundle allows attackers to inject malicious script that executes when a back end user views the Comments module, potentially leading to administrative takeover or code execution.
An access control flaw in Contao allows non-administrator back end users with access to the preview links module to view all preview links, exposing signed preview URLs for unpublished content.
A caching defect in Contao's table access security voter allows low-privileged backend users to bypass module permissions and gain unauthorized read, create, update, and delete access to database tables.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.