Medium
CVE-2026-46362
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 88
Reset filters
High
CVE-2026-43873
AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClient.json.php` Enables Cross-Site DB Dump of the Configured Clone Server
Low
CVE-2026-41663
Admidio has CSRF on Admin Preferences that Triggers Unauthorized Backup, .htaccess Write, and Email Send
Medium
CVE-2026-41658
Admidio's Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items
Critical
CVE-2026-41203
CI4MS Theme::upload is vulnerable to Zip Slip leading to RCE
Critical
CVE-2026-41202
CI4MS Backup::restore is vulnerable to Zip Slip leading to RCE
Medium
CVE-2026-41201
CI4MS: Backup Management Full Account Takeover for All Roles & Privilege Escalation via Stored DOM Blind XSS
High
CVE-2026-39393
CI4MS Vulnerable to Post-Installation Re-entry via Cache-Dependent Install Guard Bypass
Critical
CVE-2026-34563
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS
Critical
CVE-2026-34560
CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
High
CVE-2025-32957
baserCMS has Unsafe File Upload Leading to Remote Code Execution (RCE)
Medium
CVE-2026-34036
Dolibarr Core Discloses Sensitive Data via Authenticated Local File Inclusion in selectobject.php
Critical
CVE-2026-33867
AVideo has Plaintext Video Password Storage
High
CVE-2026-33293
AVideo Affected by Arbitrary File Deletion via Path Traversal in CloneSite deleteDump Parameter
Medium
CVE-2026-33238
AVideo has a Path Traversal in listFiles.json.php Enables Server Filesystem Enumeration
Medium
CVE-2026-33041
AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php
Medium
CVE-2026-32818
Admidio is Missing Authorization on Forum Topic and Post Deletion
Critical
CVE-2026-32817
Admidio is Missing Authorization and CSRF Protection on Document and Folder Deletion
High
CVE-2026-26045
Moodle has a Remote Code Execution risk via file restore
Medium
CVE-2026-25483
Craft Commerce has Stored XSS via Order Status Message with potential database exfiltration
Medium
CVE-2026-23476
FacturaScripts is Vulnerable to Reflected XSS
Medium
CVE-2026-24421
phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)
Medium
CVE-2025-69198
Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted
High
CVE-2026-21857
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.