Medium
CVE-2025-66302
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,070
Reset filters
Medium
CVE-2025-66307
Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure
Medium
CVE-2025-66312
Grav Admin Plugin is vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`
Medium
CVE-2025-66311
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters
Medium
CVE-2025-66304
Grav Exposes Password Hashes Leading to privilege escalation
Medium
CVE-2025-66303
Grav is vulnerable to a DOS on the admin panel
High
CVE-2025-66301
Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
High
CVE-2025-66300
Grav is vulnerable to Arbitrary File Read
High
CVE-2025-66299
Grav is Vulnerable to Security Sandbox Bypass with SSTI (Server Side Template Injection)
High
CVE-2025-66296
Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover
Medium
CVE-2025-65622
Snipe-IT allows stored XSS via the Locations "Country" field
Medium
CVE-2025-65621
Snipe-IT is vulnerable to stored cross-site scripting
Medium
CVE-2025-63523
FeehiCMS fails to enforce server-side immutability
Medium
CVE-2025-63520
FeehiCMS is vulnerable to cross-site scripting via the id parameter of the User Update function
Medium
CVE-2025-63522
FeehiCMS is vulnerable to reverse tabnabbing
Low
CVE-2025-13785
Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images
Low
CVE-2025-13784
yungifez Skuul School Management System vulnerable to XSS via SVG
Medium
CVE-2025-66026
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
Low
CVE-2025-65961
Contao is vulnerable to cross-site scripting in templates
Medium
CVE-2025-65960
Contao is vulnerable to remote code execution in template closures
Medium
CVE-2025-64049
REDAXO CMS is vulnerable to XSS through its module management component
High
CVE-2025-64050
REDAXO CMS is vulnerable to RCE attack through its template management component
Medium
CVE-2025-65956
Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags
Medium
CVE-2025-64027
Snipe-IT has Cross-site Scripting vulnerability in CSV import workflow
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.