Medium
CVE-2019-25727
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
High
CVE-2026-9691
Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 - Unauthenticated PHP Object Injection
High
CVE-2026-9290
WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
High
CVE-2026-49104
Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 - Unauthenticated PHP Object Injection
High
CVE-2026-10835
SALESmanago & Leadoo <= 3.11.2 - Unauthenticated SQL Injection
Medium
CVE-2026-49078
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.7.10 - Missing Authorization
High
CVE-2026-49079
JetSearch <= 3.5.17 - Unauthenticated SQL Injection
Medium
CVE-2026-9016
Debug Log Manager <= 2.5.0 - Unauthenticated Improper Output Neutralization for Logs via log_js_errors AJAX Action
Medium
CVE-2026-10823
YMC Smart Filter <= 3.11.2 - Unauthenticated Private/Draft Post Disclosure
Medium
CVE-2026-49082
Chatway Live Chat – AI Chatbot, Customer Support, FAQ & Helpdesk Customer Service & Chat Buttons <= 1.4.8 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2019-25738
Hybrid Composer <= 1.4.6 - Missing Authorization
High
CVE-2026-7654
Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value
Critical
CVE-2026-47708
MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper
Critical
ghsa-jpvj-wpmj-h7rv
Supply chain compromise via malicious @cap-js/openapi
Medium
CVE-2026-48013
Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Medium
CVE-2026-48015
Shopware: Stored XSS via SVG file upload — no SVG sanitization
Medium
CVE-2026-48016
Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment
Medium
CVE-2026-48014
Shopware: Admin API ACL Bypass in Order State Transition Endpoints
Medium
CVE-2026-48012
Shopware SSO referer trust leading to an arbitrary redirect target
Low
CVE-2026-48011
Shopware: Timing-attack on admin panel allowing enumeration of administrator usernames
Medium
CVE-2026-48010
Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts
Medium
CVE-2026-48009
Shopware: Admin Account Takeover via User Recovery Hash Exposure
Medium
CVE-2026-48008
Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass
Critical
CVE-2026-54458
WWBN AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.