Critical
CVE-2025-65108
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Critical
CVE-2025-64767
@hpke/core reuses AEAD nonces
Medium
CVE-2025-12023
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Ticket Restore
Medium
CVE-2025-12085
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Empty
Medium
CVE-2025-12022
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Trash Restore
Medium
CVE-2025-12169
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.0 - Missing Authorization to Authenitcated (Subscriber+) to Scheduled Trigger Deletion
Medium
CVE-2025-11368
LearnPress – WordPress LMS Plugin <= 4.2.9.4 - Missing Authorization to Unauthenticated Arbitrary Callback Execution to Information Exposure
High
CVE-2025-12973
S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator <= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload
Medium
CVE-2025-60794
@perfood/couch-auth may expose session tokens, passwords
Medium
CVE-2025-60798
phppgadmin contains a SQL injection vulnerability
Medium
CVE-2025-60799
phppgadmin contains an incorrect access control vulnerability
Low
CVE-2025-13435
Resty has a Path Traversal vulnerability
Medium
CVE-2025-60797
phppgadmin contains a SQL injection vulnerability
Low
CVE-2025-60796
phppgadmin vulnerable to Cross-site Scripting
Medium
CVE-2025-62754
Payment Gateway bKash for WC <= 3.1.0 - Missing Authorization
Medium
CVE-2025-10039
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'
Medium
CVE-2025-12747
Tainacan <= 1.0.0 - Unauthenticated Information Exposure
High
CVE-2025-12160
Simple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-12935
FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode
Medium
CVE-2025-66113
Better Chat Support for Messenger <= 1.2.18 - Missing Authorization
Medium
CVE-2025-66104
Offload, AI & Optimize with Cloudflare Images <= 1.9.5 - Missing Authorization
Medium
CVE-2025-10054
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal
High
CVE-2025-65103
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
High
CVE-2025-65099
Claude Code vulnerable to command execution prior to startup trust dialog
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.