Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Connections Business Directory <= 9.6 - Authenticated CSV Injection
Blog2Social: Social Media Auto Post & Scheduler <= 6.3.0 - Authenticated SQL Injection
ACF to REST API <= 3.2.0 - Insecure direct object reference via permalinks manipulation
Command injection in node-dns-sync
Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site Scripting
MapPress Maps <= 2.54.5 - Remote Code Execution via Improper Capability Checks in AJAX Calls
Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting
Final Tiles Gallery <= 3.4.18 - Authenticated Stored Cross-Site Scripting
bbPress <= 2.6.4 - Unauthenticated Privilege Escalation
bbPress <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting via the forums list table
Exposure of Sensitive Information to an Unauthorized Actor in AEgir
Insufficient output escaping of attachment names in PHPMailer
drupal/prlp - SA-CONTRIB-2020-021
drupal/commerce - SA-CONTRIB-2020-020
Form Maker by 10Web <= 1.13.35 - SQL Injection
xcloner - Other
Private key leak in Apache CXF
OS Command Injection in jw.util
MailerLite – Signup forms <= 1.4.4 - Cross-Site Request Forgery
MailerLite Signup Forms < 1.4.4 - Unauthenticated SQL Injection
ThirstyAffiliates Affiliate Link Manager <= 3.9.2 - Stored Cross-Site Scripting
Apache Camel Netty enables Java deserialization by default
Apache ActiveMQ webconsole admin GUI is open to XSS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.