Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Moodle exposed the names of hidden groups to users
Moodle sends quiz-related messages to inactive/suspended users
Moodle course access permissions are not properly checked in course_output_fragment_course_overview
Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter
FanBridge signup <= 0.6 - Cross-Site Request Forgery
ZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable
MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint
LLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery
AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injection
Sprout Clients <= 3.2.1 - Reflected Cross-Site Scripting
Simple Pull Quote <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Builderall Builder for WordPress <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Liferay Portal and DXP are Missing Authorization in Collection Provider
Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS)
Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl
Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names
Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories
Admidio Vulnerable to Authenticated SQL Injection in Member Assignment Functionality
Scapy Session Loading Vulnerable to Arbitrary Code Execution via Untrusted Pickle Deserialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.