Medium
CVE-2025-60798
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,638
Medium
CVE-2025-60799
phppgadmin contains an incorrect access control vulnerability
Low
CVE-2025-13435
Resty has a Path Traversal vulnerability
Medium
CVE-2025-60797
phppgadmin contains a SQL injection vulnerability
Low
CVE-2025-60796
phppgadmin vulnerable to Cross-site Scripting
Medium
CVE-2025-62754
Payment Gateway bKash for WC <= 3.1.0 - Missing Authorization
Medium
CVE-2025-10039
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'
Medium
CVE-2025-12747
Tainacan <= 1.0.0 - Unauthenticated Information Exposure
High
CVE-2025-12160
Simple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-12935
FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode
Medium
CVE-2025-66113
Better Chat Support for Messenger <= 1.2.18 - Missing Authorization
Medium
CVE-2025-66104
Offload, AI & Optimize with Cloudflare Images <= 1.9.5 - Missing Authorization
Medium
CVE-2025-10054
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal
High
CVE-2025-65103
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
High
CVE-2025-65099
Claude Code vulnerable to command execution prior to startup trust dialog
Medium
CVE-2025-65019
Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint
Medium
CVE-2025-64765
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
High
CVE-2025-64764
Astro vulnerable to reflected XSS via the server islands feature
Low
CVE-2025-64757
Astro Development Server has Arbitrary Local File Read
Medium
CVE-2025-64521
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account
Medium
CVE-2025-12778
Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure
Critical
CVE-2025-64408
Apache Causeway vulnerable to deserialization in Java
Medium
CVE-2025-12119
MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory
High
CVE-2025-67568
Basel <= 5.9.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.