Low
CVE-2025-13784
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,406
Reset filters
Medium
CVE-2025-66026
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
Medium
CVE-2025-65956
Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags
Medium
CVE-2025-64027
Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow
Medium
CVE-2025-60798
phppgadmin contains a SQL injection vulnerability
Medium
CVE-2025-60799
phppgadmin contains an incorrect access control vulnerability
Medium
CVE-2025-60797
phppgadmin contains a SQL injection vulnerability
Low
CVE-2025-60796
phppgadmin vulnerable to Cross-site Scripting
High
CVE-2025-65103
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
Medium
CVE-2025-65093
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
Medium
CVE-2025-63828
Backdrop CMS Host Header Injection vulnerability
Low
CVE-2025-12761
drupal/simple_multistep - SA-CONTRIB-2025-116
Medium
CVE-2025-12760
drupal/email_tfa - SA-CONTRIB-2025-115
Low
CVE-2025-65014
LibreNMS has Weak Password Policy
Medium
CVE-2025-65013
LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`
Medium
CVE-2025-65012
Kirby CMS has cross-site scripting (XSS) in the changes dialog
High
CVE-2025-62519
phpMyFAQ has Authenticated SQL Injection in Configuration Update Functionality
Medium
ghsa-2w46-vq8h-98vh
Shopware 6's password recovery link does not expire after email change
Low
CVE-2025-64711
PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
Medium
CVE-2025-64714
PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
High
CVE-2025-64500
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
Low
CVE-2025-13083
Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels
High
CVE-2025-64519
TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter
Medium
CVE-2025-64174
OpenMage vulnerable to XSS in Admin Notifications
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.