Medium
CVE-2025-68978
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-68977
DesignThemes Portfolio Addon <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-14804
Frontend File Manager <= 23.4 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-68532
ModelTheme Addons for WPBakery and Elementor < 1.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-68568
Claspo – Popups, Spin the Wheel & Email Capture <= 1.0.7 - Missing Authorization
Medium
CVE-2025-68587
Watu Quiz <= 3.4.5 - Missing Authorization
Medium
CVE-2025-68573
Simple Keyword to Link <= 1.5 - Cross-Site Request Forgery
Medium
CVE-2025-14719
Relevanssi < 4.26.0 (Free) < 2.29.0 (Premium) - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-68574
WPBakery Visual Composer WHMCS Elements <= 1.0.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12976
Events Manager <= 7.2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'events_list_grouped' Shortcode
Medium
CVE-2025-68566
My auctions allegro <= 3.6.33 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2025-13641
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 3.59.12 - Authenticated (Contributor+) Local File Inclusion via 'template'
High
CVE-2025-68154
systeminformation has a Command Injection vulnerability in fsSize() function on Windows
High
CVE-2025-68150
Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
High
CVE-2025-68155
@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint
High
CVE-2025-71399
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
High
CVE-2025-68130
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
Medium
CVE-2025-68115
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables
Medium
CVE-2025-14399
Download Plugins and Themes from Dashboard <= 1.9.6 - Cross-Site Request Forgery to Bulk Plugin/Theme Archival
Medium
CVE-2025-12496
Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery
High
CVE-2025-11924
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
Medium
CVE-2025-13750
Converter for Media <= 6.3.2 - Missing Authorization to Authenticated (Subscriber+) Optimized Image Deletion via regenerate-attachment REST Endpoint
Medium
CVE-2025-65581
ABP Account Module has an Open Redirect through Improper validation in its register function
Medium
CVE-2025-14061
Cookie Banner, Cookie Consent, Consent Log, Cookie Scanner, Script Blocker (for GDPR, CCPA & ePrivacy) : WP Cookie Consent <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.