Medium
CVE-2025-2540
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-34076
Microweber CMS API has authenticated local file inclusion vulnerability
Medium
CVE-2024-9017
PeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description
Unrated
CVE-2025-7031
drupal/config_pages_viewer - SA-CONTRIB-2025-086
Unrated
CVE-2025-7030
drupal/tfa - SA-CONTRIB-2025-085
Medium
CVE-2025-5944
Element Pack Addons for Elementor <= 8.0.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-caption Attribute
Medium
CVE-2024-5647
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
Medium
CVE-2025-6174
WordPress Qwizcards <= 3.94 - Reflected Cross-Site Scripting
High
CVE-2025-2932
JKDEVKIT <= 1.9.4 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2025-60241
Premmerce <= 1.3.19 - Unauthenticated Local File Inclusion
High
CVE-2025-60210
Everest Forms - Frontend Listing <= 1.0.5 - Unauthenticated PHP Object Injection
Medium
CVE-2025-53103
junit-platform-reporting can leak Git credentials through its OpenTestReportGeneratingListener
Medium
CVE-2025-2330
All-in-One Addons for Elementor – WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget
High
CVE-2025-4946
Vikinger <= 1.9.32 - Authenticated (Subscriber+) Arbitrary File Deletion via vikinger_delete_activity_media_ajax Function
High
CVE-2025-53110
@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix
High
CVE-2025-53109
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
High
CVE-2025-48379
Pillow vulnerability can cause write buffer overflow on BCn encoding
Medium
CVE-2024-13451
Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure
High
CVE-2025-6464
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion
High
CVE-2025-6463
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
Low
CVE-2025-4654
Soumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion
High
CVE-2025-5014
Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2025-5817
Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-6686
Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.