Medium
CVE-2025-62901
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,632
Medium
CVE-2025-68893
Image shrinker <= 1.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-57692
PiranhaCMS stored XSS
Medium
CVE-2025-9944
Professional Contact Form <= 1.0.0 - Cross-Site Request Forgery to Test Email Sending
Medium
CVE-2025-9898
cForms – Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery
Medium
CVE-2025-9894
Sync Feedly <= 1.0.1 - Cross-Site Request Forgery to Sync Trigger
Medium
CVE-2025-9899
Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2025-9893
VM Menu Reorder plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-9896
HidePost <= 2.3.8 - Cross-Site Request Forgery
High
CVE-2025-9816
WP Statistics <= 14.15.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
High
CVE-2025-59845
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass
Medium
CVE-2025-59364
express-xss-sanitizer has an unbounded recursion depth
Critical
CVE-2025-59936
get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass
Medium
CVE-2025-10499
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-10498
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion
Medium
CVE-2025-8440
Team Members <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Low
CVE-2025-1396
WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled
Medium
CVE-2025-54831
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively
High
CVE-2025-56769
Hutool allows remote code execution (RCE) via the QLExpressEngine class
Medium
CVE-2025-60093
Download Manager <= 3.3.24 - Cross-Site Request Forgery
Medium
CVE-2025-60177
Recaptcha – wp <= 0.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-60116
Grand Conference Theme Custom Post Type < 2.6.4 - Missing Authorization
Medium
CVE-2025-60109
LambertGroup - AllInOne - Content Slider <= 3.8 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-60167
Page Manager for Elementor <= 2.0.5 - Authenticated (Subscriber+) Sensitive Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.