Medium
ghsa-ppm4-r2vc-pg74
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,563
Medium
CVE-2024-35240
Umbraco Commerce vulnerable to Stored Cross-site Scripting on Print Functionality
Medium
ghsa-vpr3-cw3h-prw8
SimpleSAMLphp Reflected Cross-site Scripting vulnerability
Low
CVE-2024-35239
Umbraco Forms components vulnerable to Stored Cross-site Scripting
Critical
CVE-2024-35374
Mocodo vulnerable to SQL injection in `/web/generate.php`
Medium
CVE-2024-5086
Essential Addons for Elementor PRO – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team Member Carousel Widget
Medium
ghsa-7wh8-jrq7-p27f
SimpleSAMLphp exposes credentials in session storage
Medium
ghsa-v858-922f-fj9v
SimpleSAMLphp Link Injection vulnerability
High
ghsa-xc69-p8fc-m6m5
silverstripe/subsites Unsafe SQL Query Construction (Safe Data Source)
High
ghsa-p2v5-xcqm-4fv6
silverstripe/taxonomy SQL Injection vulnerability
Medium
ghsa-55pp-293f-3365
silverstripe/userforms file upload exposure on UserForms module
Medium
CVE-2024-35621
formwork Cross-site scripting vulnerability in Markdown fields
Medium
CVE-2024-4419
Fetch JFT <= 1.8.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2024-35219
OpenAPI Generator Online - Arbitrary File Read/Delete
High
ghsa-wjg9-v8cf-f5q2
silverstripe/graphql Cross-Site Request Forgery vulnerability
High
ghsa-265q-222x-52m6
silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector
High
ghsa-cwgq-83w5-8jfq
silverstripe/framework has possible denial of service attack vector when flushing
Medium
ghsa-m2hh-2m46-x6j5
silverstripe/framework may disclose database credentials during connection failure
Medium
CVE-2024-0434
WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly <= 1.7.1 - Missing Authorization via ttbm_new_place_save
High
CVE-2024-4611
AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass
Critical
CVE-2024-5150
Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check
Medium
CVE-2024-3276
Lightbox & Modal Popup WordPress Plugin – FooBox (Free and Premium) <= 2.7.27 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2024-5204
Swiss Toolkit For WP <= 1.0.7 - Authenticated (Contributor+) Authentication Bypass
Critical
CVE-2024-3412
WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.