Medium
CVE-2025-4597
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,687
Low
CVE-2025-46701
Apache Tomcat - CGI security constraint bypass
Medium
CVE-2025-5235
OpenSheetMusicDisplay <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
Medium
CVE-2025-5142
Simple Page Access Restriction <= 1.0.31 - Cross-Site Request Forgery via Multiple Parameters
Medium
CVE-2025-4431
Featured Image Plus <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update
Medium
CVE-2025-5236
NinjaTeam Chat for Telegram <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter
Medium
CVE-2025-4943
LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via data-lakit-element-link Parameter
High
CVE-2025-48882
PHPOffice Math allows XXE when processing an XML file in the MathML format
Low
CVE-2025-46570
Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching
Medium
CVE-2025-46722
vLLM has a Weakness in MultiModalHasher Image Hashing Implementation
Medium
CVE-2025-5259
Minimal Share Buttons <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter
Medium
CVE-2025-5276
Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function
Medium
CVE-2025-5273
Markdownify MCP Server allows attackers to read arbitrary files
Medium
CVE-2025-47651
Infility Global <= 2.12.7 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2025-31052
The Fashion - Model Agency One Page Beauty Theme <= 1.4.4 - Unauthenticated PHP Object Injection
Medium
CVE-2025-48335
Responsive Plus <= 3.2.0 - Missing Authorization
High
CVE-2025-39358
WP Posts Carousel <= 1.3.12 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-4652
Broadstreet Ads <= 1.51.7 - Reflected Cross-Site Scripting
Medium
CVE-2025-4659
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure
Medium
CVE-2025-48241
Verge3D <= 4.9.3 - Reflected Cross-Site Scripting
High
CVE-2025-5190
Browse As <= 0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie
Critical
CVE-2025-48336
Course Builder - Online Course WordPress Theme < 3.6.6 - Unauthenticated PHP Object Injection
High
CVE-2025-31050
Apptha Slider Gallery <= 2.5 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-49922
WPeMatico RSS Feed Fetcher <= 2.8.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.