Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Logtik <= 2.3 - Reflected Cross-Site Scripting
Subrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool
Axios is vulnerable to DoS attack through lack of data size check
Liferay Portal is vulnerable to Insecure Direct Object Reference (IDOR) attack through Authentication Bypass
Liferay Portal API Allows Authenticated Users to Access Workflow Definitions by Name
Spotify Embed Creator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Ultimate Blogroll <= 2.5.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Embed Google Datastudio <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Side Slide Responsive Menu <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Prebid-universal-creative latest on npm briefly compromised
Prebid.js NPM package briefly compromised
The Events Calendar <= 6.15.1 - Unauthenticated SQL Injection
jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin
LWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'
Rank Math SEO <= 1.0.252.1 - Authenticated (Subscriber+) Information Exposure
CTL Behance Importer Lite <= 1.0 - Unauthenticated SQL Injection
Rank Math SEO <= 1.0.252.1 - Missing Authorization
Recipe Card Blocks for Gutenberg & Elementor <= 3.4.8 - Incorrect Authorization
WooCommerce Fortnox Integration <= 4.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Ajax WooSearch <= 1.0.0 - Unauthenticated SQL Injection
Woocommerce Envato Affiliates <= 1.2.1 - Reflected Cross-Site Scripting
Time Tracker <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion
Angular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.