High
CVE-2025-12154
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,638
Medium
CVE-2025-11222
Central Dogma's Login Function Has an Open Redirect Vulnerability
Low
CVE-2025-66479
Anthropic Sandbox Runtime Incorrectly Implemented Network Sandboxing
High
CVE-2025-65945
auth0/node-jws Improperly Verifies HMAC Signature
Medium
CVE-2025-12190
Image Optimizer by wps.sk <= 1.2.0 - Cross-Site Request Forgery to Bulk Image Optimization
Medium
CVE-2025-13512
CoSign Single Signon <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-12165
Webcake – Landing Page Builder <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Medium
CVE-2025-12189
Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload
Medium
CVE-2025-12163
Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-13528
Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter
Medium
CVE-2025-13360
Quantic Social Image Hover <= 1.0.8 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-12191
PDF Catalog for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-12128
Hide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-13006
SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Unauthenticated Information Exposure
Medium
CVE-2025-12417
SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-13494
SSP Debug <= 1.0.0 - Unauthenticated Sensitive Information Exposure
Critical
CVE-2025-13313
CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint
Medium
CVE-2025-13312
CRM Memberships <= 2.6 - Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action
Medium
CVE-2025-13362
Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update
High
CVE-2025-65346
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
High
CVE-2025-13066
Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
Medium
CVE-2025-11759
Backup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()
Medium
CVE-2025-12804
Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode
High
CVE-2025-13543
PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.