High
CVE-2025-62527
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
ghsa-vffh-c9pq-4crh
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Medium
CVE-2025-62522
vite allows server.fs.deny bypass via backslash on Windows
Medium
ghsa-xvp7-8vm8-xfxx
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers
Low
CVE-2025-57325
rollbar vulnerable to prototype pollution
Medium
CVE-2025-62508
Citizen vulnerable to stored XSS in sticky header button messages
High
CVE-2025-57738
Apache Syncope allows malicious administrators to inject Groovy code
Low
CVE-2025-61417
TastyIgniter vulnerable to Cross-Site Scripting
Medium
CVE-2025-11536
Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
Medium
CVE-2025-62979
ACF to REST API <= 3.3.4 - Unauthenticated Information Exposure
Medium
CVE-2025-62978
KiotViet Sync <= 1.8.5 - Missing Authorization
Medium
CVE-2025-49899
Whydonate <= 4.0.15 - Missing Authorization
Medium
CVE-2026-28044
Rocket <= 3.19.4 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-49908
WPC Countdown Timer for WooCommerce <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Unrated
838
Phoca commander
Medium
CVE-2025-49336
Pondol BBS <= 1.1.8.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-63047
ListingPro <= 2.9.9 - Missing Authorization
Medium
CVE-2025-63048
ListingPro Lead Form <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62973
BuddyForms <= 2.9.0 - Missing Authorization
Medium
CVE-2025-62976
Sendle Shipping <= 6.02 - Missing Authorization
Medium
CVE-2025-62971
Attesa Extra <= 1.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62975
Raychat <= 2.2.1 - Cross-Site Request Forgery
Medium
CVE-2025-64219
Business Directory <= 6.4.18 - Missing Authorization
Medium
CVE-2025-63046
ListingPro <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.