Medium
CVE-2025-13072
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,638
Medium
CVE-2025-5092
Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
Medium
CVE-2025-13073
HandL UTM Grabber / Tracker <= 2.8.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-67552
Walker Core <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-60455
Modular Max Serve has Unsafe Deserialization vulnerability
High
CVE-2025-12484
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-13035
Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains
Medium
CVE-2025-65089
XWiki view file macro: User can view content of office file without view rights on the attachment
Medium
CVE-2025-65093
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
High
CVE-2025-64076
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bound
Medium
CVE-2025-63828
Backdrop CMS Host Header Injection vulnerability
Low
CVE-2025-12761
drupal/simple_multistep - SA-CONTRIB-2025-116
Medium
CVE-2025-12760
drupal/email_tfa - SA-CONTRIB-2025-115
Critical
CVE-2025-12383
Eclipse Jersey has a Race Condition
Low
CVE-2025-65014
LibreNMS has Weak Password Policy
Medium
CVE-2025-65013
LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`
Medium
CVE-2025-13085
SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure
Medium
CVE-2025-65012
Kirby CMS has cross-site scripting (XSS) in the changes dialog
Medium
CVE-2025-12535
SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution
High
CVE-2025-13145
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import
Medium
CVE-2025-54990
XWiki AdminTools application doesn't set permissions on the AdminTools space
Medium
CVE-2025-12878
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode
High
CVE-2026-15291
Chat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12814
SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.