Medium
CVE-2025-10902
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-61413
Piranha CMS vulnerable to stored cross-site scripting (XSS)
High
CVE-2025-62713
Kottster app reinitialization can be re-triggered allowing command injection in development mode
Medium
CVE-2025-11429
Keycloak does not invalidate sessions when "Remember Me" is disabled
Medium
CVE-2025-12110
Keycloak does not invalidate offline sessions when the offline_access scope is removed
Medium
CVE-2025-62256
Liferay Portal and DXP do not properly restrict access to OpenAPI
Medium
CVE-2025-62398
Moodle does not properly enforce MFA
Medium
CVE-2025-62396
Moodle's error handling leads to sensitive information disclosure
Medium
CVE-2025-62401
Moodle has a time restriction bypass
High
CVE-2025-62399
Moodle vulnerable to brute-force password guesses
Medium
CVE-2025-62400
Moodle exposed the names of hidden groups to users
Medium
CVE-2025-62394
Moodle sends quiz-related messages to inactive/suspended users
Medium
CVE-2025-62393
Moodle course access permissions are not properly checked in course_output_fragment_course_overview
Medium
CVE-2025-7730
Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter
Medium
CVE-2025-62986
FanBridge signup <= 0.6 - Cross-Site Request Forgery
Medium
CVE-2025-12134
ZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable
Medium
CVE-2025-64366
MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection
Critical
CVE-2025-6440
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
High
CVE-2025-64188
Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Medium
CVE-2025-12136
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint
Medium
CVE-2025-11257
LLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import
High
CVE-2025-10861
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-11576
AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injection
Medium
CVE-2025-66118
Sprout Clients <= 3.2.1 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.