Most applications are built largely from third-party code: frameworks, JavaScript libraries, web servers and databases. When one of them has a known vulnerability (a CVE), attackers can often exploit it with public tools, without finding anything new in your code.

How it happens

Components are installed once and forgotten. Months later a CVE is published for that version, and automated scanners on the internet start looking for it. Front-end libraries such as old jQuery or AngularJS versions are especially common.

Why it matters

• Exploitation of known, published vulnerabilities.
• Failing audits that require patch management.
• Supply-chain risk from abandoned libraries.

How to prevent it

• Keep an inventory of the components and versions you run.
• Subscribe to security advisories for your stack.
• Patch on a regular schedule, and urgently for critical CVEs.
• Remove libraries you no longer use.
• Hide version numbers in banners and headers.

How Vooki Pro helps

• Fingerprints server, framework, CMS, database and JavaScript library versions with 177 version checks.
• Expands detected versions into per-CVE findings using a CVE database of more than 10,000 entries.
• Flags outdated JavaScript libraries such as jQuery, AngularJS, Lodash, Moment.js, Bootstrap, React and Vue.
• Includes checks for high-profile CVE classes such as Log4Shell, Spring4Shell, Shellshock and Heartbleed.

Frequently asked questions

How do attackers find outdated components?

They read version numbers from headers, file paths and JavaScript, then match them against public CVE databases, often automatically.

Which components are most often outdated?

Front-end JavaScript libraries such as jQuery and AngularJS, CMS plugins, and web server versions are among the most common.

Related: Login and password security best practices · WordPress security best practices