Medium
CVE-2025-49574
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,741
Medium
CVE-2025-5258
Conference Scheduler <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
Medium
CVE-2025-52967
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
Unrated
828
JS Jobs - XSS (Cross Site Scripting)
High
CVE-2025-52826
Sala <= 1.1.3 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-52774
Infility Global <= 2.13.4 - Reflected Cross-Site Scripting
Medium
CVE-2025-52778
xili-dictionary <= 2.12.5.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-49290
Off-Canvas Sidebars & Menus (Slidebars) <= 0.5.8.4 - Reflected Cross-Site Scripting
High
CVE-2025-30992
Puca <= 2.6.33 - Unauthenticated Local File Inclusion
Medium
CVE-2025-32297
Simple Link Directory < 14.8.1 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-28993
Content No Cache <= 0.1.4 - Unauthenticated Arbitrary Function Call
Medium
CVE-2025-52799
LMS <= 9.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-49321
Eventin <= 4.0.28 - Reflected Cross-Site Scripting
High
CVE-2025-39474
Amely <= 3.1.4 - Unauthenticated SQL Injection
Medium
CVE-2025-52818
Trusty Whistleblowing <= 2.0.1 - Missing Authorization
Medium
CVE-2025-31067
Seven Stars <= 1.4.4 - Reflected Cross-Site Scripting
Medium
CVE-2025-39488
MagOne <= 8.8 - Reflected Cross-Site Scripting
High
CVE-2025-24765
Image Shadow <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2025-52816
Zita <= 1.6.5 - Unauthenticated Local File Inclusion
Medium
CVE-2025-24774
WPCRM - CRM for Contact form CF7 & WooCommerce <= 3.2.0 - Reflected Cross-Site Scripting
High
CVE-2025-6206
Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
CVE-2025-32281
WPKit For Elementor <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Options Update
Medium
CVE-2025-52817
Abandoned Contact Form 7 < 2.9 - Missing Authorization
High
CVE-2025-52829
DirectIQ Email Marketing <= 2.0 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.