Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 15
Reset filtersWinter: CSRF through AJAX handler names reachable as backend page actions
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
Winter: My Account preview exposes another backend user's profile by record ID
Winter: Stored XSS through Backend List widget image columns
Winter: Local File Inclusion through @import directives in LESS compilation of backend customizable stylesheets and theme assets
Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata
Winter: Authenticated backend users can bypass Users controller permission checks
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Winter: Stored XSS through Editor Settings custom styles
Winter: Stored XSS through Brand Settings custom styles
Winter vulnerable to privilege escalation by authenticated backend users
Winter CMS Local File Inclusion through Server Side Template Injection
Winter CMS Stored XSS through Backend ColorPicker FormWidget
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.