Medium
CVE-2025-7367
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Critical
CVE-2025-7340
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-7360
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move
Critical
CVE-2025-7341
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-10134
Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-5393
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-5394
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
High
CVE-2025-53689
Apache Jackrabbit vulnerable to blind XXE attack due to insecure document build
Critical
CVE-2025-60207
Custom User Registration Fields for WooCommerce <= 2.1.2 - Unauthenticated Arbitrary File Upload
High
CVE-2025-7667
Restrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion
Medium
CVE-2025-49954
WP-Click-Tracker <= 0.7.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-49955
Smart Flexslider <= 2.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-60239
CoSchool LMS <= 1.4.3 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-49956
Fade Slider <= 2.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-49957
Email Attachment by Order Status & Products <= 1.0.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-53865
In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive).
High
CVE-2025-53194
JetEngine <= 3.7.1 - Authenticated (Contributor+) Server-Side Template Injection to Remote Code Execution
High
CVE-2024-41169
Apache Zeppelin exposes server resources to unauthenticated attackers
Medium
CVE-2025-49373
Evergreen Content Poster <= 1.4.5 - Cross-Site Request Forgery
High
CVE-2025-60240
AnyComment <= 0.3.6 - Unauthenticated Local File Inclusion
High
CVE-2025-6423
BeeTeam368 Extensions <= 2.3.5 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2025-30402
ExecuTorch vulnerable to Heap-based Buffer Overflow attack
Medium
ghsa-hq75-xg7r-rx6c
Better Call routing bug can lead to Cache Deception
High
CVE-2025-1313
Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.