Medium
CVE-2025-65093
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 423
Reset filters
Medium
CVE-2025-65013
LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`
High
CVE-2025-64500
Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
High
CVE-2025-47776
MantisBT vulnerable to authentication bypass for some passwords due to PHP type juggling
Medium
CVE-2025-62796
PrivateBin is missing HTML sanitization of attached filename in file size hint
Medium
CVE-2025-62508
Citizen vulnerable to stored XSS in sticky header button messages
Medium
CVE-2025-62414
bagisto has Cross Site Scripting (XSS) in Create New Customer
Critical
CVE-2025-62417
bagisto has CSV Formula Injection in Create New Product
Low
CVE-2025-62412
LibreNMS alert-rules has a Cross-Site Scripting Vulnerability
High
CVE-2025-56588
Dolibarr vulnerable to RCE via the computed field parameter
Low
CVE-2025-55745
UnoPim has CSV Injection on Quick Export feature
Medium
CVE-2025-49138
HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter
Medium
CVE-2025-30159
Kirby vulnerable to path traversal of snippet names in the `snippet()` helper
Low
CVE-2025-30207
Kirby vulnerable to path traversal in the router for PHP's built-in server
Medium
CVE-2025-31493
Kirby vulnerable to path traversal of collection names during file system lookup
Medium
CVE-2025-23204
API Platform Core does not call GraphQl securityAfterResolver
Medium
CVE-2025-30152
Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout
Medium
CVE-2025-29788
Sylius PayPal Plugin Payment Amount Manipulation Vulnerability
Medium
CVE-2025-24013
Missing validation of header name and value in codeigniter4/framework
Critical
CVE-2025-25286
Crayfish allows Remote Code Execution via Homarus Authorization header
High
CVE-2025-21612
Extension:TabberNeue vulnerable to Cross-site Scripting
Critical
CVE-2024-51092
LibreNMS has an Authenticated OS Command Injection
Low
CVE-2024-43432
Moodle authorization headers preserved between "emulated redirects"
Medium
CVE-2024-46998
baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.