Medium
CVE-2025-66312
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-66311
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
Medium
CVE-2025-66304
Grav Exposes Password Hashes Leading to privilege escalation
Medium
CVE-2025-66303
Grav is vulnerable to a DOS on the admin panel
High
CVE-2025-66301
Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
High
CVE-2025-66300
Grav is vulnerable to Arbitrary File Read
High
CVE-2025-66299
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
High
CVE-2025-66296
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
Medium
CVE-2025-11538
Keycloak has debug default bind address
Medium
CVE-2025-65622
Snipe-IT allows stored XSS via the Locations "Country" field
Medium
CVE-2025-66110
Tiktok Feed <= 1.0.23 - Missing Authorization
Medium
CVE-2025-67595
Quiz Maker <= 6.7.0.82 - Cross-Site Request Forgery
Medium
CVE-2025-59133
Projectopia <= 5.1.22 - Authenticated (Custom+) Insecure Direct Object Reference
Medium
CVE-2025-64238
WPS Bidouille <= 1.33.1 - Missing Authorization
Medium
CVE-2025-13090
WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-65621
Snipe-IT is vulnerable to stored cross-site scripting
High
CVE-2025-71401
Better Auth affected by external request basePath modification DoS
High
CVE-2025-14874
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
High
CVE-2025-13516
SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload
High
CVE-2025-13724
VikRentCar Car Rental Management System <= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' Parameter
High
CVE-2025-55749
XWiki Jetty Package (XJetty) allows accessing any application file through URL
Medium
CVE-2025-11726
Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification
Medium
CVE-2025-13696
Zigaform <= 7.6.5 - Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint
Medium
CVE-2025-13685
Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.