Medium
CVE-2025-0767
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
High
CVE-2024-9195
WHMPress - WHMCS Client Area <= 4.3-revision-3- Authenticated (Subscriber+) Arbitrary Options Update
High
CVE-2024-12811
Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Medium
CVE-2025-0764
wpForo Forum <= 2.4.1 - Authenticated (Subscriber+) Arbitrary File Read in update
High
CVE-2025-1570
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP
High
CVE-2025-1687
Cardealer <= 1.6.4 - Cross-Site Request Forgery to User Update via update_user_profile
Medium
CVE-2024-10860
NextMove Lite – Thank You Page for WooCommerce <= 2.19.0 - Missing Authorization to Authenticated (Subscriber+) Deactivation Reason Submission
High
CVE-2025-1682
Cardealer <= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-22624
FooGallery <= 2.4.29 - Reflected Cross-Site Scripting
Medium
CVE-2025-1681
Cardealer <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files
Medium
CVE-2024-13796
Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.6 - Unauthenticated User Information Exposure
Unrated
pysec-2025-7
Posts scraped data to IP address associated with other malware distribution attacks.
Unrated
pysec-2025-6
Exfiltrates cookies to hardcoded IP address
Unrated
pysec-2025-5
Exfiltrates user cookies to hardcoded server endpoint during normal operations
Unrated
pysec-2025-3
When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.
Medium
CVE-2024-13734
Card Elements for Elementor <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget
Medium
CVE-2022-25773
Mautic allows Relative Path Traversal in assets file upload
High
CVE-2024-47053
Mautic allows Improper Authorization in Reporting API
Critical
CVE-2024-47051
Mautic allows Remote Code Execution and File Deletion in Asset Uploads
Unrated
pysec-2025-4
When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.
High
CVE-2025-1634
io.quarkus:quarkus-resteasy: Memory Leak in Quarkus RESTEasy Classic When Client Requests Timeout
Medium
CVE-2024-6261
Image Photo Gallery Final Tiles Grid <= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Medium
CVE-2025-0469
Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13905
OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.