Medium
CVE-2025-62044
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-62052
One Page Express Companion <= 1.6.43 - Missing Authorization
High
CVE-2025-62056
News Event <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-59575
MasterStudy LMS <= 3.6.20 - Authenticated (Instructor+) Sensitive Information Exposure
Medium
CVE-2025-62015
Advanced Coupons for WooCommerce Coupons <= 4.6.8 - Authenticated (Shop manager+) SQL Injection
High
CVE-2025-62055
Academist < 1.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-62058
Houzez Theme - Functionality < 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62028
Salient < 17.4.0 - Missing Authorization
Medium
CVE-2025-62030
tagDiv Composer <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62961
Sparkle FSE <= 1.0.9 - Missing Authorization
Medium
CVE-2025-63061
Kallyas <= 4.22.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62071
Social proof testimonials and reviews by Repuso <= 5.29 - Missing Authorization
Medium
CVE-2025-62026
Blockspare <= 3.2.13.2 - Authenticated (Contributor+) Sensitive Information Exposure
Medium
CVE-2025-62069
MDTF <= 1.3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62068
e2pdf <= 1.28.09 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-61922
Customer account takeover via email in PrestaShop Checkout module for PrestaShop
Medium
ghsa-3xgr-h5hq-7299
GeoIP processor disables SSL certificate validation when downloading databases
Medium
ghsa-28gg-8qqj-fhh5
OpenSearch Data Prepper uses deprecated SSL protocol identifier
Critical
CVE-2025-62410
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
High
CVE-2025-62371
OpenSearch Data Prepper plugins trust all SSL certificates by default
High
CVE-2025-62381
`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`
Low
CVE-2025-62380
Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails
Critical
CVE-2025-10850
Felan Framework <= 1.1.4 - Hardcoded Credentials
Medium
CVE-2025-10849
Felan Framework <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.