Medium
CVE-2025-11370
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-13652
CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter
Medium
CVE-2025-11723
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.5 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14034
ilGhera Support System for WooCommerce <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Deletion
High
CVE-2026-21452
MessagePack for Java Vulnerable to Remote DoS via Malicious EXT Payload Allocation
Medium
CVE-2025-14153
Page Expire Popup/Redirection for WordPress <= 1.0 - Authenticated (Author+) SQL Injection via 'id' Shortcode Attribute
Medium
CVE-2026-0604
FastDup <= 2.7 - Authenticated (Contributor+) Path Traversal via 'dir_path' REST Parameter
Medium
CVE-2025-13409
Form Vibes – Database Manager for Forms <= 1.4.13 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-13746
ForumWP – Forum & Discussion Board <= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
High
CVE-2025-15364
Download Manager <= 3.3.40 - Unauthenticated Limited Privilege Escalation via updatePassword
Medium
CVE-2025-15022
Vaadin vulnerable to Cross-site Scripting
High
CVE-2025-66518
Apache Kyuubi Server vulnerable to Path Traversal
Medium
CVE-2026-24636
Sugar Calendar (Lite) <= 3.9.1 - Missing Authorization
Medium
CVE-2025-63019
Cookies and Content Security Policy <= 2.34 - Unauthenticated Information Exposure
Medium
CVE-2026-22469
DeepDigital <= 1.0.2 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-68558
Depicter Slider <= 4.0.4 - Missing Authorization
Medium
CVE-2025-67921
Lobo < 2.8.6 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-67917
Traveler <= 3.2.6 - Missing Authorization
Medium
CVE-2025-68507
Icegram <= 3.1.35 - Missing Authorization
Medium
CVE-2025-68523
Spiffy Calendar <= 5.0.7 - Missing Authorization
Medium
CVE-2025-67915
Timetics <= 1.0.46 - Incorrect Authorization to Authenticated (Timetics Customer+) User Creation
Medium
CVE-2025-69345
Post and Page Builder by BoldGrid <= 1.27.9 - Missing Authorization
Medium
CVE-2025-67922
Grand Restaurant < 7.0.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-69091
Demo Importer Plus <= 2.0.8 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.