Medium
CVE-2025-11835
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-12580
SMS for WordPress <= 1.1.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-12582
Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset
Medium
CVE-2025-8871
Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
Medium
CVE-2025-64228
SUMO Affiliates Pro <= 11.0.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-64275
Booking Manager <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49913
CoSchedule <= 3.4.0 - Missing Authorization
Critical
CVE-2025-12674
KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-62106
WP-CRM System <= 3.4.5 - Missing Authorization
Medium
CVE-2025-49903
ZoloBlocks <= 2.3.11 - Missing Authorization
Medium
CVE-2025-64365
Ohio Extra <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12677
KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure
Medium
CVE-2025-64220
Rey Core <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64174
OpenMage vulnerable to XSS in Admin Notifications
Medium
CVE-2025-62520
MantisBT unauthorized disclosure of private project column configuration
Medium
CVE-2025-55155
MantisBT lacks verification when changing a user's email address
Critical
Exploited in attacks
CVE-2025-11953
@react-native-community/cli has arbitrary OS command injection
Medium
CVE-2025-46556
MantisBT Vulnerable to Denial-of-Service (DoS) via Excessive Note Length
High
CVE-2025-47776
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling
Medium
CVE-2025-12400
LMB^Box Smileys <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-11733
Footnotes Made Easy <= 3.0.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-11812
Reuse Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-12452
Visit Counter 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-11758
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.