High
e203fc8f-fc57-4918-8ef2-3ba6ae979d40
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,591
Medium
CVE-2019-20204
Postie <= 1.9.40 - Cross-Site Scripting
Medium
CVE-2019-20203
Postie <= 1.9.40 - Post Submission Spoofing & Stored Cross-Site Scripting
High
CVE-2020-5244
BuddyPress <= 5.1.1 - Sensitive Information Disclosure
High
e46ff294-0be1-47c1-8c21-f6242c6f832a
Import and export users and customers 1.15 - Sensitive Data Exposure
Critical
Exploited in attacks
CVE-2019-10758
Remote Code Execution Vulnerability in NPM mongo-express
High
CVE-2019-25149
Gallery Images Ape <= 2.0.6 - Authenticated Plugin Deactivation
Medium
CVE-2019-20210
CTHthemes CityBook Theme < 2.3.4, TownHub Theme < 1.0.6, EasyBook Theme < 1.2.2 - Cross-Site Scripting
Medium
CVE-2019-25143
GDPR Cookie Compliance <= 4.0.2 - Missing Authorization
High
CVE-2019-20211
CTHthemes CityBook <= 2.3.3, TownHub <= 1.0.5, and EasyBook <= 1.2.1 - Stored Cross-Site Scripting
Medium
3ec4e870-dd0f-4ec5-a03c-da47e6c1ef61
bbPress Login Register Links On Forum Topic Pages <= 2.7.5 - Cross-Site Request Forgery
High
CVE-2019-20212
CTHthemes CityBook <= 2.3.3, TownHub <= 1.0.5, and EasyBook <= 1.2.1 - Stored Cross-Site Scripting
Medium
CVE-2019-20209
CTHthemes CityBook < 2.3.4, TownHub < 1.0.6, EasyBook < 1.2.2 Themes - Authenticated Post Deleition via IDOR
Unrated
CVE-2019-20008
In Archery before 1.3, inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will result in stored XSS on the vulnerability-scan scheduling page.
High
CVE-2019-12418
Insufficiently Protected Credentials in Apache Tomcat
High
CVE-2019-17563
In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack
Critical
CVE-2019-19919
Prototype Pollution in handlebars
Medium
CVE-2019-16789
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
High
ghsa-m5ff-3wj3-8ph4
HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress
High
f796b282-0012-4d86-914d-72c7707dce42
bbPress Members Only <= 1.2.1 - Cross-Site Request Forgery
Medium
766b5c62-0701-47d5-9839-445c2654d3e0
WP Accessibility < 1.7.0 - Authenticated Stored Cross-Site Scripting
High
4270a5c2-abc0-4505-9683-030dc08a462d
Featured Image from URL <= 2.7.7 - Missing Authorization on REST API routes
Medium
ed5cf097-1b27-4d20-b7b2-2aa909bce042
BuddyPress <= 5.1.0 - Denial of Service
Medium
CVE-2019-16786
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.