Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload
Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
Service Finder SMS System <= 2.0.0 - Authentication Bypass
Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
InvokeAI has External Control of File Name or Path
WhatsApp Chat for WordPress and WooCommerce <= 1.2.1 - Reflected Cross-Site Scripting
JetEngine <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
@sequa-ai/sequa-mcp has Command Injection vulnerability
Parcel has an Origin Validation Error vulnerability
Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
Keycloak SMTP Inject Vulnerability
jinjava has Sandbox Bypass via JavaType-Based Deserialization
Jenkins has a log message injection vulnerability
Jenkins has a missing permission check, allowing users to obtain agent names
Jenkins is missing a permission check in the authenticated users' profile menu
Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
Picklescan Bypass is Possible via File Extension Mismatch
Liferay search widget vulnerable to Cross-site Scripting
Liferay Portal allows remote attackers to view display page templates via crafted URLs
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.