Critical
CVE-2025-1750
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,741
Medium
CVE-2025-3919
WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Critical
Exploited in attacks
CVE-2025-49113
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
Medium
CVE-2025-5420
juzaweb CMS allows cross-site scripting by uploading an SVG file
Medium
CVE-2025-48133
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.4.0.2 - Missing Authorization
High
CVE-2025-49072
Mr. Murphy - Custom Dress Tailoring Clothing WordPress Theme < 1.2.12.1 - Unauthenticated PHP Object Injection
High
CVE-2025-4224
wpForo + wpForo Advanced Attachments <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-49069
Contact Forms by Cimatti Plugin <= 1.9.8 - Cross-Site Request Forgery
Medium
CVE-2025-49068
Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-2939
Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution
Medium
CVE-2018-25111
django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.
Medium
CVE-2025-5034
WP File Download <= 6.2.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-4691
Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure
Medium
CVE-2025-48955
Para Server Logs Sensitive Information
Medium
CVE-2025-48943
vLLM allows clients to crash the openai server with invalid regex
Medium
CVE-2025-48942
vLLM DOS: Remotely kill vllm over http with invalid JSON schema
Medium
CVE-2025-48887
vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`
Critical
CVE-2025-4607
PSW Front-end Login & Registration <= 1.12 - Insufficiently Random Values to Unauthenticated Account Takeover/Privilege Escalation via customer_registration Function
Medium
CVE-2025-4590
Daisycon prijsvergelijkers <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-4672
Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function
Critical
CVE-2025-4631
Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint
Medium
CVE-2025-4595
FastSpring <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5285
Product Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter
High
CVE-2025-4103
WP-GeoMeta 0.3.4 - 0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.