Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A missing authentication check in ApostropheCMS allows unauthenticated users with a standard CSRF cookie to trigger cleanup operations and delete temporary export files, as well as modify job records in the database.
A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.
A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.
In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.
An unauthenticated resource exhaustion vulnerability in ApostropheCMS allows remote attackers to trigger large chunked upload processing and cleanup operations without authentication, potentially leading to denial of service.
A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.
A NoSQL injection vulnerability in the ApostropheCMS import-export module allows authenticated users to match and overwrite unintended documents using crafted update-key values.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.