Alta
CVE-2025-66021
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 71.639
Alta
CVE-2025-71400
Better Auth Passkey Plugin allows passkey deletion through IDOR
Alta
CVE-2025-9624
OpenSearch is vulnerable to DoS via complex query_string inputs
Baja
CVE-2025-65961
Contao is vulnerable to cross-site scripting in templates
Media
CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
Alta
Explotada en ataques
CVE-2025-58360
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
Media
CVE-2025-21621
GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format
Media
CVE-2025-64049
REDAXO CMS is vulnerable to XSS through its module management component
Alta
CVE-2025-64050
REDAXO CMS is vulnerable to RCE attack through its template management component
Media
CVE-2025-13466
body-parser is vulnerable to denial of service when url encoding is used
Crítica
CVE-2025-13597
AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload
Crítica
CVE-2025-13595
CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload
Media
CVE-2025-67471
Quick Contact Form <= 8.2.5 - Cross-Site Request Forgery
Media
CVE-2025-66078
Hotel Booking Lite <= 5.2.3 - Authenticated (Hotel Worker+) Remote Code Execution
Media
CVE-2025-67588
Elementor Website Builder <= 3.33.0 - Missing Authorization
Media
CVE-2025-66072
UsersWP <= 1.2.47 - Missing Authorization
Media
CVE-2025-67597
Fluent Booking <= 1.9.11 - Missing Authorization
Baja
ghsa-j4gv-6x9v-v23g
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
Media
CVE-2025-65956
Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags
Media
CVE-2025-65944
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
Media
CVE-2025-13389
Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure
Media
CVE-2025-13452
Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages
Media
CVE-2025-13414
Chamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export
Media
CVE-2025-12634
Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.