Medium
CVE-2025-13386
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-13370
ProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter
High
CVE-2025-13376
ProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload
Medium
CVE-2025-12645
Inline frame – Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-13383
Job Board by BestWebSoft <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via $_GET Array Storage
Medium
CVE-2025-13385
Bookme <= 4.2 - Authenticated (Admin+) SQL Injection via 'filter[status]' Parameter
Medium
CVE-2025-13380
AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read
Medium
CVE-2025-12032
ZWeb - Social Mobile <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-13405
Ace Post Type Builder <= 1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Custom Taxonomy Deletion via 'taxonomy' Parameter
Medium
CVE-2025-12587
Peer Publish <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2025-13404
atec Duplicate Page & Post <= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and Data Exposure
High
CVE-2025-13609
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent'
High
CVE-2025-13068
Telegram Bot & Channel <= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username
Critical
CVE-2025-13559
EduKart Pro <= 1.0.3 - Unauthenticated Privilege Escalation
Medium
CVE-2025-13558
Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing
High
CVE-2025-65998
Apache Syncope's AES encryption stores hard-coded passwords in internal database
Medium
CVE-2025-10646
Search Exclude <= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API
Critical
CVE-2025-6389
Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
Medium
CVE-2025-10144
Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-64260
ANAC XML Bandi di Gara <= 7.7 - Reflected Cross-Site Scripting
Medium
CVE-2025-12684
URL Shortify <= 1.11.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-11363
Royal Elementor Addons and Templates <= 1.7.1036 - Missing Authorization to Unauthenticated Media File Upload
Medium
CVE-2025-66087
PropertyHive <= 2.1.12 - Missing Authorization
Medium
CVE-2025-66088
PropertyHive <= 2.1.12 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.