Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Stored XSS using uppercase characters in HTMLEditor
Silverstipe CMS Stored XSS in custom meta tags
Silverstripe XSS in shortcodes
XSS via uploaded gpx file
URL XSS vulnerability due to outdated jquery in CMS
Uncaught exception in engine.io
Cross site scripting vulnerability with discussion titles
`CHECK` failure in `SobolSample` via missing validation
`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode
Missing Authorization in Filter Stream Converter Application of XWiki-platform
Exposure of Private Personal Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-rest-server
Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-livetable-ui
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-menu-ui
Plaintext storage of password after a reset in org.xwiki.platform:xwiki-platform-security-authentication-default
Creation of new database tables through login form on PostgreSQL
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in xwiki-platform-icon-ui
Missing Authorization to enable or disable users in org.xwiki.platform:xwiki-platform-user-profile-ui
Missing Authorization in User#setDisabledStatus in org.xwiki.platform:xwiki-platform-oldcore
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml
Cross-Site Request Forgery (CSRF) allowing to delete or rename tags
Prevent RCE when deserializing untrusted user input
Fastify: Incorrect Content-Type parsing can lead to CSRF attack
Invalid char to bool conversion when printing a tensor
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.