Medium
CVE-2025-6740
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-34086
Bolt CMS vulnerable to authenticated remote code execution
High
CVE-2025-53370
Citizen vulnerable to Stored XSS through short descriptions
High
CVE-2025-49826
Next.JS vulnerability can lead to DoS via cache poisoning
Low
CVE-2025-49005
Next.js has a Cache poisoning vulnerability due to omission of the Vary header
High
CVE-2025-53368
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions
Medium
CVE-2025-52554
n8n is vulnerable to Improper Authorization through its `/stop` endpoint
Medium
CVE-2025-6673
Easy restaurant menu manager <= 2.0.1 - Authenticated (Contributot+) Stored Cross-Site Scripting via `nsc_eprm_menu_link` Shortcode
Medium
CVE-2024-11937
Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48939
tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
Medium
CVE-2025-5567
Shortcodes Ultimate <= 7.4.0 - Authenticted (Contributor+) Stored Cross-Site Scripting via 'data-url' Attribute
Medium
CVE-2025-49595
n8n Vulnerable to Denial of Service via Malformed Binary Data Requests
High
CVE-2025-6586
Download Plugin <= 2.2.8 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2025-6786
DocCheck Login <= 1.1.5 - Unauthorized Post Access
Medium
CVE-2025-6041
yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-5933
RD Contacto <= 1.4 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-5924
WP Firebase Push Notification <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification
Medium
CVE-2025-6729
PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-6787
Smart Docs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-6814
Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function
Medium
CVE-2025-6039
ProcessingJS for WordPress <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-6782
GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()
High
CVE-2025-6783
GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via emdedSc()
High
CVE-2025-5953
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.