Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore
Dusk plugin may allow unfettered user authentication in misconfigured installs
Mautic: MST-48 Server-Side Request Forgery in Asset section
Mautic Sensitive Data Exposure due to inadequate user permission settings
Mautic SQL Injection in dynamic Reports
Mautic vulnerable to Relative Path Traversal / Arbitrary File Deletion due to GrapesJS builder
Timber <= 1.23.0 - Authenticated (Admin+) PHP Object Injection
Mautic vulnerable to cross-site scripting in notifications via saving Dashboards
Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode
Reportico affected by Incorrect Access Control
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload
AWP Classifieds <= 4.3.1 - Cross-Site Request Forgery
Pardot <= 2.1.0 - Missing Authorization
eCommerce Product Catalog <= 3.3.28 - Cross-Site Request Forgery
WPZOOM Social Feed Widget & Block <= 2.1.13 - Missing Authorization to Authenticated (Subscriber+) Instagram Image Deletion
Responsive Contact Form Builder & Lead Generation Plugin <= 1.9.7 - Authenticated (Admin+) Stored Cross-Site Scripting
Podlove Podcast Publisher <= 4.1.0 - Missing Authorization
Zoho Campaigns <= 2.0.7 - Cross-Site Request Forgery via zcwc_optin_save
Remove Footer Credit <= 1.0.13 - Authenticated (Administrator+) Stored Cross-Site Scripting
Gift Vouchers <= 4.4.0 - Cross-Site Request Forgery
Appointment Bookings for Zoom GoogleMeet and more – Wappointment <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery
WP Client Reports <= 1.0.22 - Cross-Site Request Forgery
Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.