Medium
CVE-2025-54045
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,687
Medium
CVE-2025-48231
Booking Calendar Contact Form <= 1.2.58 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-53393
akka-cluster-metrics uses Java serialization for cluster metrics
Medium
CVE-2025-62886
Pricing Table builder <= 1.5.1 - Cross-Site Request Forgery
Low
CVE-2025-32897
Apache Seata Vulnerable to Deserialization of Untrusted Data
Medium
CVE-2025-6462
EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via SQLREPORT Shortcode
Low
ghsa-vh5j-5fhq-9xwg
Taylor has race condition in /get-patch that allows purchase token replay
High
CVE-2025-53093
TabberNeue vulnerable to Stored XSS through wikitext
Medium
CVE-2025-5937
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset
High
CVE-2025-6755
Game Users Share Buttons <= 1.3.0 - Authenticated (Subscriber+) Arbitrary File Deletion via themeNameId Parameter
Critical
CVE-2025-5304
PT Project Notebooks 1.0.0 - 1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via wpnb_pto_new_users_add Function
Medium
CVE-2025-6252
Qi Addons For Elementor <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-44163
raspap-webgui has a Directory Traversal vulnerability
High
CVE-2025-52999
jackson-core can throw a StackoverflowError when processing deeply nested data
Medium
CVE-2025-6350
WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-6379
BeeTeam368 Extensions Pro <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion
High
CVE-2025-6381
BeeTeam368 Extensions <= 2.3.4 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Deletion
Medium
CVE-2025-49592
n8n allows open redirects via the /signin endpoint
Medium
CVE-2025-5731
Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information
Low
CVE-2025-6736
JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components
Low
CVE-2025-6735
JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing Import Page component
Medium
CVE-2025-53318
WP DB Booster <= 1.0.1 - Missing Authorization
Medium
CVE-2025-53195
JetEngine <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-53262
Writesonic <= 1.0.5 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.