Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Validator.isValidSafeHTML is being deprecated and will be deleted from org.owasp.esapi:esapi in 1 year
Uptime Kuma Authenticated remote code execution via TailscalePing
Apache Superset has Incorrect Default Permissions
Apache Superset Cross-site Scripting vulnerability
Apache DolphinScheduler Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Happyforms <= 1.25.9 - Reflected Cross-Site Scripting
Antispam Bee <= 2.11.3 - IP Address Spoofing via get_client_ip
Delete Post Revisions In WordPress <= 4.6 - Cross-Site Request Forgery
Evergreen Content Poster <= 1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
HUSKY – Products Filter for WooCommerce (formerly WOOF) <= 1.3.4.2 - Unauthenticated SQL Injection via search terms
Campaign Monitor for WordPress <= 2.8.12 - Reflected Cross-Site Scripting
teachPress <= 9.0.4 - Cross-Site Request Forgery
Swift Performance Lite <= 2.3.6.14 - Missing Authorization to Unauthenticated Settings Export
Restricted Site Access <= 7.4.1 - IP Spoofing to Protection Mechanism Bypass
RegistrationMagic <= 5.2.2.6 - Cross-Site Request Forgery
BookingPress <= 1.0.76 - Authenticated (Administrator+) Arbitrary File Upload
Simple Long Form <= 2.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Mollie Payments for WooCommerce <= 7.3.11 - Authenticated (Shop Manager+) Arbitrary File Upload
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
SoundCloud Shortcode <= 3.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
WP Shortcodes Plugin — Shortcodes Ultimate <= 5.13.3 - Insecure Direct Object Reference to Information Disclosure
12 Step Meeting List <= 3.14.24 - Authenticated (Contributor+) Server-Side Request Forgery
Qode Essential Addons <= 1.5.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.