High
CVE-2025-28381
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,741
Medium
CVE-2025-28380
A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.
Critical
CVE-2025-28388
OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.
Critical
CVE-2025-28386
A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.
Medium
CVE-2025-49578
starcitizentools/citizen-skin allows stored XSS in user registration date message
Medium
CVE-2025-49579
starcitizentools/citizen-skin allows stored XSS in menu heading message
Medium
CVE-2025-49577
starcitizentools/citizen-skin allows stored XSS in preference menu heading messages
Medium
CVE-2025-49576
starcitizentools/citizen-skin allows stored XSS in search no result messages
Critical
CVE-2024-38824
Salt vulnerable to directory traversal attack in file receiving method
Medium
CVE-2025-41234
Spring Framework vulnerable to a reflected file download (RFD)
Medium
CVE-2025-62883
Premmerce User Roles <= 1.0.13 - Missing Authorization
Medium
CVE-2025-53237
Wizard Cloak <= 1.0.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-5920
Sharable Password Protected Posts <= 1.1.0 - Unauthenticated Password protected Post Exposure
Critical
CVE-2024-56158
XWiki allows SQL injection in query endpoint of REST API with Oracle
Medium
CVE-2025-6012
Auto Attachments <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-29744
pg-promise SQL Injection vulnerability
Low
CVE-2025-43863
vantage6 lacks brute-force protection on change password functionality
Low
CVE-2025-43866
Vantage6 Server JWT secret not cryptographically secure
Medium
CVE-2025-5815
Traffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-4586
IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode
Medium
CVE-2025-4584
IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode
Medium
CVE-2025-4585
IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmflat' Shortcode
Medium
CVE-2025-5233
Color Palette <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter
Critical
CVE-2025-5288
REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.