High
CVE-2025-3530
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-3529
WordPress Simple PayPal Shopping Cart <= 5.1.2 - Unauthenticated Information Exposure via file_url Parameter
Critical
CVE-2025-32965
Compromised xrpl.js versions 4.2.1, 4.2.2, 4.2.3, 4.2.4, and 2.14.2
Medium
CVE-2025-32788
OctoPrint Authenticated Reverse Proxy Page Authentication Bypass
Medium
CVE-2025-32961
XSS in the /download Endpoint of the JPA Web API
Medium
CVE-2025-32960
XSS in the /files Endpoint of the Generic REST API
Medium
CVE-2025-32959
Cuba has a DoS in the File Storage
Medium
CVE-2025-32952
io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage
Medium
CVE-2025-32951
io.jmix.rest:jmix-rest allows XSS in the /files Endpoint of the Generic REST API
Medium
CVE-2025-32950
io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage
Medium
CVE-2025-39393
Hospital Management System <= 47.0(20-11-2023) - Reflected Cross-Site Scripting
Medium
CVE-2025-46235
SKT Blocks <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-46251
VikRestaurants Table Reservations and Take-Away <= 1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-64234
Evergreen Content Poster <= 1.4.5 - Missing Authorization
Medium
CVE-2025-46240
Simple Download Counter <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-46243
Recover abandoned cart for WooCommerce <= 2.2 - Cross-Site Request Forgery
Medium
CVE-2026-28138
uListing <= 2.2.0 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2025-46236
HTML Forms <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-1054
UiCore Elements – Free Elementor widgets and templates <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2025-39350
wProject < 5.8.0 - Missing Authorization to Unauthenticated Content Modification and Deletion
Medium
CVE-2025-46239
Theme Switcha <= 3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-46244
Advanced Linked Variations for Woocommerce <= 1.0.3 - Missing Authorization
Medium
CVE-2025-46238
List Last Changes <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-64284
Majestic Support <= 1.0.7 - Authenticated (Contributor+) Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.