High
CVE-2025-2800
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-53818
GitHub Kanban MCP Server vulnerable to Command Injection
Medium
CVE-2025-6977
ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function
Medium
CVE-2025-53889
Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows
Medium
CVE-2025-48795
Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged
High
CVE-2025-6965
SQLitePCLRaw.lib.e_sqlite3 has a vulnerable dependency on SQLite
Medium
CVE-2025-53887
Directus' exact version number is exposed by the OpenAPI Spec
Medium
CVE-2025-53886
Directus tokens are not redacted in flow logs, exposing session credentials to all admin
Medium
CVE-2025-53885
Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged
Medium
CVE-2025-6747
Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-28965
URL Shortener <= 3.0.7 - Missing Authorization
Medium
CVE-2025-49958
Robokassa payment gateway for Woocommerce <= 1.8.1 - Reflected Cross-Site Scripting
High
CVE-2025-31422
Visual Art | Gallery WordPress Theme <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-28949
Mediabay - WordPress Media Library Folders <= 1.4 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-60203
Store Exporter <= 2.7.6 - Unauthenticated Local File Inclusion
High
CVE-2025-60232
KBx Pro Ultimate <= 8.0.5 - Unauthenticated PHP Object Injection
Medium
CVE-2025-60075
hpb seo plugin for WordPress <= 3.0.1 - Reflected Cross-Site Scripting
High
CVE-2025-60204
WooCommerce Store Toolkit <= 2.4.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-47645
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-5284
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-53836
XWiki Rendering is vulnerable to RCE attacks when processing nested macros
Critical
CVE-2025-53835
XWiki Rendering is vulnerable to XSS attacks through insecure XHTML syntax
Critical
CVE-2025-53833
LaRecipe is vulnerable to Server-Side Template Injection attacks
Medium
CVE-2025-4369
Companion Auto Update <= 3.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.