According to its self-reported version number, the Atlassian Jira application running on the remote host is 10.3.x prior to 10.3.13 or 11.x prior to 11.2.0. It is, therefore, affected by a XML External Entity Injection (XXE) vulnerability.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Bitbucket application running on the remote host is affected by a command injection vulnerability. A remote attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled "Allow public signup".

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the instance of Joomla! running on the remote web server is 4.x prior to 4.4.13 or 5.x prior to 5.2.6. It is, therefore, affected by multiple vulnerabilities.

- Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. (CVE-2025-25226)

- Insufficient state checks lead to a vector that allows to bypass 2FA checks. (CVE-2025-25227)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version number, Roundcube Webmail is 1.6.x prior to 1.6.16 or 1.7.x prior to 1.7.1. Therefore, it may be affected by an unauthenticated SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

Adobe Magento Open Source / Commerce versions 2.4.7 < 2.4.7-p1, 2.4.6 < 2.4.6-p6, 2.4.5 < 2.4.5-p8, 2.4.4 < 2.4.4-p9 and earlier suffer from an XML External Entity (XXE) vulnerability. By exploiting this vulnerability and crafting a malicious XML document, a remote and unauthenticated attacker could achieve Remote Code Execution (RCE) on the vulnerable Magento instance.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 6.13.23, 6.14.x prior to 7.4.11, 7.5.x prior to 7.11.6 or 7.12.x prior to 7.12.5. It is, therefore, affected by an OGNL injection vulnerability that would allow an authenticated user, and in some instances an unauthenticated user, to execute arbitrary code on a Confluence Server or Data Center instance.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9 through 13.8.8 / 13.9.6 / 13.10.3. This is the result of improper validation of image files by a 3rd-party file parser Exif-Tool, resulting in a remote command execution.

Spring MVC and Spring WebFlux applications, when packaged as a traditional WAR file, running on JDK version 9 and higher in an Apache Tomcat servlet container and exposing one or more endpoints with DataBinder enabled, suffer from a Remote Code Execution (RCE) vulnerability.

By crafting a specific HTTP request, an attacker could leverage the vulnerability to compromise the target by, for example, hosting a web shell on the target application.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.39.12, 1.42.x prior to 1.42.6 or 1.43.x prior to 1.43.1. It is, therefore, affected by a number of vulnerabilities as follows.

- Improper restrictions on the file revert action. (CVE-2025-32696)

- PermissionManager fails to differentiate between cascading protection sources, allowing an unauthorized user to edit protected pages. (CVE-2025-32697)

- LogPager restriction enforcement functions do not properly restrict access to suppressed log entries. (CVE-2025-32698)

- Potential JavaScript injection via Unicode normalization enabling XSS attacks. (CVE-2025-32699)

- An i18n XSS vulnerability in HTMLMultiSelectField with sections. (CVE-2025-3469)

- AbuseFilter log interfaces expose private/hidden filters when they should be restricted. (CVE-2025-32700)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
115081	Atlassian Jira 11.x < 11.2.0 XML External Entity Injection	Web App Scanning	Component Vulnerability	12/17/2025	12/17/2025	critical
113445	Atlassian Bitbucket 8.3.x < 8.3.3 Command Injection	Web App Scanning	Component Vulnerability	11/24/2022	3/14/2023	critical
114773	Joomla! 5.x < 5.2.6 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	4/17/2025	4/17/2025	medium
115258	Roundcube Webmail 1.6.x < 1.6.16 SQL Injection	Web App Scanning	Component Vulnerability	6/4/2026	6/4/2026	high
115259	Roundcube Webmail 1.7.x < 1.7.1 SQL Injection	Web App Scanning	Component Vulnerability	6/4/2026	6/4/2026	high
114325	Adobe Commerce / Magento XML External Entity Injection (CosmicSting)	Web App Scanning	Component Vulnerability	6/26/2024	7/18/2024	critical
112963	Atlassian Confluence 7.5.x < 7.11.6 Webwork OGNL Injection	Web App Scanning	Component Vulnerability	9/10/2021	3/14/2023	critical
113044	GitLab 11.9.x < 13.8.8 / 13.9.x < 13.9.6 / 13.10.x < 13.10.3 Remote Code Execution	Web App Scanning	Component Vulnerability	11/9/2021	3/23/2022	critical
113217	Spring Framework < 5.2.20 / 5.3.x < 5.3.18 Remote Code Execution (Spring4Shell)	Web App Scanning	Component Vulnerability	3/31/2022	6/17/2026	critical
115341	MediaWiki < 1.39.12 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	7/28/2026	7/28/2026	low

Detections

Analytics

Plugins Search

critical

critical

medium

high

high

critical

critical

critical

critical

low