Medium
CVE-2025-10304
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-13495
FluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter
Medium
CVE-2025-12585
MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
Medium
CVE-2025-13448
CSSIgniter Shortcodes <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute
High
CVE-2025-13646
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition
High
CVE-2025-13645
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion
Critical
CVE-2025-13542
DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation
Medium
CVE-2025-66400
mdast-util-to-hast has unsanitized class attribute
High
CVE-2025-66298
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
High
CVE-2025-66294
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
Medium
CVE-2025-66310
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab
Medium
CVE-2025-66309
Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab
High
CVE-2025-66297
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
Medium
CVE-2025-66308
Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`
High
CVE-2025-66295
Grav vulnerable to Path traversal / arbitrary YAML write via user creation leading to Account Takeover / System Corruption
Low
CVE-2025-10939
Keycloak unable to restrict access to the admin console
High
CVE-2025-66412
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
Medium
CVE-2025-66405
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host
High
CVE-2025-66305
Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
Medium
CVE-2025-66306
Grav vulnerable to Information Disclosure via IDOR in Grav Admin Panel
Medium
CVE-2025-66415
fastify-reply-from affected by bypass of reply forwarding
Medium
CVE-2025-66302
Grav vulnerable to Path Traversal allowing server files backup
Medium
CVE-2025-66307
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
Critical
CVE-2025-66401
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.