Kritisch
CVE-2025-28916
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 8.950
Filter zurücksetzen
Mittel
CVE-2025-1973
Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
Hoch
CVE-2025-1971
Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Mittel
CVE-2025-2477
CryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter
Hoch
CVE-2025-0724
ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection
Mittel
CVE-2025-1408
ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management
Mittel
CVE-2025-2331
GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure
Hoch
CVE-2025-2186
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'
Mittel
CVE-2025-26874
MemberSpace <= 2.1.13 - Reflected Cross-Site Scripting
Mittel
CVE-2024-13920
Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
Hoch
CVE-2024-13921
Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Hoch
CVE-2025-2539
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
Hoch
CVE-2025-1770
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion
Kritisch
CVE-2025-2505
Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
Kritisch
CVE-2025-26909
Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion
Kritisch
CVE-2024-12922
Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current
Hoch
CVE-2024-12563
s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode
Hoch
CVE-2024-12295
BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password
Kritisch
CVE-2024-13790
MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion
Kritisch
CVE-2024-13442
Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover
Kritisch
CVE-2024-13410
CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler
Mittel
CVE-2025-2290
LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
Kritisch
CVE-2025-23937
LinkedIn Lite <= 1.0 - Unauthenticated Local File Inclusion
Mittel
CVE-2024-51624
Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.