Crítica
CVE-2025-28916
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 8.950
Restablecer filtros
Media
CVE-2025-1973
Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
Alta
CVE-2025-1971
Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Media
CVE-2025-2477
CryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter
Alta
CVE-2025-0724
ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection
Media
CVE-2025-1408
ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management
Media
CVE-2025-2331
GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure
Alta
CVE-2025-2186
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'
Media
CVE-2025-26874
MemberSpace <= 2.1.13 - Reflected Cross-Site Scripting
Media
CVE-2024-13920
Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
Alta
CVE-2024-13921
Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Alta
CVE-2025-2539
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
Alta
CVE-2025-1770
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion
Crítica
CVE-2025-2505
Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
Crítica
CVE-2025-26909
Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion
Crítica
CVE-2024-12922
Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current
Alta
CVE-2024-12563
s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode
Alta
CVE-2024-12295
BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password
Crítica
CVE-2024-13790
MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion
Crítica
CVE-2024-13442
Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover
Crítica
CVE-2024-13410
CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler
Media
CVE-2025-2290
LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
Crítica
CVE-2025-23937
LinkedIn Lite <= 1.0 - Unauthenticated Local File Inclusion
Media
CVE-2024-51624
Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.