Medium
CVE-2025-67551
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
High
CVE-2025-12482
Booking for Appointments and Events Calendar – Amelia <= 1.2.35 - Unauthenticated SQL Injection via search
Medium
CVE-2025-67571
WPFunnels <= 3.6.2 - Missing Authorization
Medium
CVE-2025-64261
Appointment Booking Calendar <= 1.3.95 - Missing Authorization
Medium
CVE-2025-12841
Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-64369
Contact Form Email <= 1.3.58 - Missing Authorization
Critical
CVE-2025-55449
AstrBot is vulnerable to RCE with hard-coded JWT signing keys
High
ghsa-m8jr-fxqx-8xx6
Apollo Federation has Improper Enforcement of Access Control on Transitive Fields
Medium
CVE-2025-64747
Directus is Vulnerable to Stored Cross-site Scripting
Medium
CVE-2025-64746
Directus has Improper Permission Handling on Deleted Fields
High
CVE-2025-71328
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change
High
CVE-2025-71337
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)
High
CVE-2025-71335
Flowise Fails to Invalidate Existing Sessions After Password Changes
Medium
ghsa-2w46-vq8h-98vh
Shopware 6's password recovery link does not expire after email change
Low
CVE-2025-64711
PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
Medium
CVE-2025-64714
PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
High
CVE-2025-13204
expr-eval vulnerable to Prototype Pollution
Medium
CVE-2025-12849
Contest Gallery <= 28.0.2 - Missing Authorization
High
CVE-2025-64530
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields
Medium
CVE-2025-12847
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion
Medium
CVE-2025-12494
Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move
Medium
CVE-2025-12182
Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize
Medium
CVE-2025-64718
js-yaml has prototype pollution in merge (<<)
Medium
CVE-2025-67539
Select Core < 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.