Medium
CVE-2025-47939
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,221
Reset filters
Low
CVE-2025-47936
TYPO3 CMS Webhooks Server Side Request Forgery
Medium
CVE-2025-30159
Kirby vulnerable to path traversal of snippet names in the `snippet()` helper
Low
CVE-2025-30207
Kirby vulnerable to path traversal in the router for PHP's built-in server
Medium
CVE-2025-31493
Kirby vulnerable to path traversal of collection names during file system lookup
Medium
Exploited in attacks
CVE-2025-35939
Craft CMS stores arbitrary content provided by unauthenticated users in session files
High
CVE-2025-46347
YesWiki Remote Code Execution via Arbitrary PHP File Write and Execution
Critical
CVE-2025-46348
YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download
Unrated
CVE-2025-3734
drupal/stage_file_proxy - SA-CONTRIB-2025-035
Medium
CVE-2025-30148
Silverstripe Framework has a XSS vulnerability in HTML editor
High
ghsa-cj3w-g42v-wcj6
ibexa/fieldtype-richtext allows access to external entities in XML
High
ghsa-2jqj-5qv2-xvcg
ezsystems/ezplatform-richtext allows access to external entities in XML
Critical
CVE-2025-22871
RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency
Low
CVE-2025-30166
Pimcore's Admin Classic Bundle allows HTML Injection
High
CVE-2025-3192
Browsershot Server-Side Request Forgery (SSRF) via setURL() Function
High
CVE-2025-31131
Yeswiki Path Traversal vulnerability allows arbitrary read of files
High
CVE-2025-31691
drupal/oauth2_server - SA-CONTRIB-2025-020
Medium
CVE-2025-28094
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting (XSS)
Medium
CVE-2025-28093
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Email Settings
Medium
CVE-2025-28092
ShopXO Vulnerable to Server-Side Request Forgery (SSRF) via Image Upload
Medium
CVE-2025-30741
Pixelfed may allow unauthorized actor to view private posts and private users
Medium
CVE-2025-27794
Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwrite
Medium
CVE-2025-48958
Froxlor has an HTML Injection Vulnerability
Medium
CVE-2025-71418
PocketMine-MP allows malicious client data to waste server resources due to lack of limits for explode()
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.