Medium
CVE-2025-8779
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Critical
CVE-2025-10738
URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection
High
CVE-2025-53960
Apache StreamPark: Use the user’s password as the secret key Vulnerability
Critical
CVE-2025-65854
MineAdmin has an insecure default password
High
ghsa-5j59-xgg2-r9c4
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
Medium
CVE-2025-12362
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval
Medium
ghsa-c6m7-q6pr-c64r
Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components
High
ghsa-cpqf-f22c-r95x
Vite Plugin React has a Denial of Service Vulnerability in React Server Components
High
CVE-2025-67779
Denial of Service Vulnerability in React Server Components
High
CVE-2025-13094
WP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-14508
MediaCommander – Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion
Medium
CVE-2025-13705
Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter
Medium
CVE-2025-14539
Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter
Medium
CVE-2025-14378
Quick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-13077
افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection
Medium
CVE-2025-14394
Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update
Medium
CVE-2025-14395
Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions
Medium
CVE-2025-14462
Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14451
Solutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter
High
CVE-2025-14476
Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import
Medium
CVE-2025-14540
Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure
Medium
CVE-2025-13092
Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Unauthenticated Information Expsoure
Medium
CVE-2025-13093
Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update
Critical
CVE-2025-14440
JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.