Medium
CVE-2025-68454
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 620
Reset filters
Medium
CVE-2026-21451
Bagisto has HTML Filter Bypass that Enables Stored XSS
High
ghsa-6mp4-q625-mxjp
YOURLS is vulnerable to XSS through JSONP and Callback request parameters
Low
ghsa-mgr9-6c2j-jxrq
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
Medium
CVE-2025-68951
phpMyFAQ has Stored XSS in user list via admin-managed display_name
Medium
CVE-2025-68614
LibreNMS Alert Rule API Cross-Site Scripting Vulnerability
Medium
CVE-2023-53929
phpMyFAQ contains a CSV injection vulnerability
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Medium
CVE-2025-66843
Grav is vulnerable to Stored XSS through authenticated user-edited content
Medium
CVE-2025-65186
Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor
High
CVE-2025-66298
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
High
CVE-2025-66294
Grav is vulnerable to RCE via SSTI through Twig Sandbox Bypass
Medium
CVE-2025-66310
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab
Medium
CVE-2025-66309
Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab
High
CVE-2025-66297
Grav vulnerable to Privilege Escalation and Authenticated Remote Code Execution via Twig Injection
Medium
CVE-2025-66308
Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`
High
CVE-2025-66305
Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter
Medium
CVE-2025-66312
Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`
Medium
CVE-2025-66311
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
High
CVE-2025-66301
Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
Medium
CVE-2025-64049
REDAXO CMS is vulnerable to XSS through its module management component
High
CVE-2025-64050
REDAXO CMS is vulnerable to RCE attack through its template management component
Medium
CVE-2025-65956
Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags
Medium
CVE-2025-65093
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.