Medium
CVE-2025-8778
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-10040
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure
Medium
CVE-2025-9622
WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing
Medium
CVE-2025-10126
MyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9857
Heateor Login – Social Login Plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-7049
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
High
CVE-2025-7718
Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover
Medium
CVE-2025-7843
Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2025-7826
Testimonial <= 2.3 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-6189
Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter
Medium
CVE-2025-9979
Maspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export
Medium
CVE-2025-9888
Maspik <= 2.5.6 - Cross-Site Request Forgery
Medium
CVE-2025-43776
Liferay Portal and Liferay DXP vulnerable to store Cross-site Scripting
Medium
CVE-2025-52277
YesWiki Cross Site Scripting vulnerability
Critical
Exploited in attacks
CVE-2025-54236
Magento Community Edition Improper Input Validation vulnerability
High
CVE-2025-59037
DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware
Medium
CVE-2025-59019
TYPO3 CSV download feature information disclosure
High
CVE-2025-59018
TYPO3 Workspaces Module Information Disclosure
Medium
CVE-2025-59017
TYPO3 backend modules have Broken Access Control
Medium
CVE-2025-59016
TYPO3 CMS exposes sensitive information in an error message
Medium
CVE-2025-59015
TYPO3 CMS uses insufficient entropy when generating passwords
Medium
CVE-2025-59014
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
CVE-2025-59013
TYPO3 CMS has an open‑redirect vulnerability
Medium
CVE-2025-43778
Liferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.