Medium
CVE-2025-6385
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Critical
CVE-2025-6441
Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass
Medium
CVE-2025-6387
WP Get The Table <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
Medium
CVE-2025-7966
Get Youtube Subs <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Function
Medium
CVE-2025-7959
Station Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters
Medium
CVE-2025-7822
WP Wallcreeper <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable
Medium
CVE-2025-5084
Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']
Medium
CVE-2025-6539
Voltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Medium
CVE-2025-8071
Mine CloudVod <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter
Medium
CVE-2025-4608
Structured Content <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode
Medium
CVE-2025-7780
AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions
High
CVE-2025-7695
Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route
High
CVE-2025-53015
ImageMagick has XMP profile write that triggers hang due to unbounded loop
Medium
CVE-2025-50481
A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a
Unrated
CVE-2025-8092
drupal/cookies - SA-CONTRIB-2025-092
Critical
CVE-2025-7437
Ebook Store <= 5.8012 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-7852
WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
High
CVE-2025-8021
files-bucket-server vulnerable to Directory Traversal
High
CVE-2025-8020
private-ip vulnerable to Server-Side Request Forgery
High
CVE-2025-8022
bun vulnerable to OS Command Injection
Medium
CVE-2025-52734
CropRefine <= 1.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-50053
Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App <= 0.8.8.8 - Reflected Cross-Site Scripting
Critical
CVE-2025-6715
LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion
High
CVE-2025-48171
Cena Store <= 2.11.26 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.