Medium
CVE-2025-68569
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,632
Medium
CVE-2025-68603
Editorial Calendar <= 3.8.8 - Missing Authorization
High
CVE-2025-68987
Cinerama - A WordPress Theme for Movie Studios and Filmmakers <= 2.4 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-67626
SEO Search <= 1.1 - Cross-Site Request Forgery
High
CVE-2025-68985
Aora <= 1.3.15 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-68983
Greenmart <= 4.2.11 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-68984
Puca <= 2.6.39 - Authenticated (Contributor+) Local File Inclusion
Low
ghsa-24v3-254g-jv85
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature
Medium
CVE-2025-13467
Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization
High
CVE-2023-53957
Kimai contains a SameSite cookie vulnerability
Medium
CVE-2025-12492
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14298
FiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode
Low
CVE-2025-68457
Orejime has executable code in HTML attributes
High
CVE-2025-68478
External Control of File Name or Path in Langflow
Critical
CVE-2025-13619
Flex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation
Medium
CVE-2025-13624
Overstock Affiliate Links <= 1.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-14164
Quran Gateway <= 1.5 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-14721
Responsive and Swipe slider <= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-12898
Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure
Medium
CVE-2025-13365
WP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-12581
Attachments Handler <= 1.1.7 - Reflected Cross-Site Scripting
Medium
CVE-2025-14168
WP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanup
Medium
CVE-2025-14734
Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14735
Amazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.