Medium
CVE-2025-62961
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-63061
Kallyas <= 4.22.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62071
Social proof testimonials and reviews by Repuso <= 5.29 - Missing Authorization
Medium
CVE-2025-62026
Blockspare <= 3.2.13.2 - Authenticated (Contributor+) Sensitive Information Exposure
Medium
CVE-2025-62069
MDTF <= 1.3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62068
e2pdf <= 1.28.09 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-61922
Customer account takeover via email in PrestaShop Checkout module for PrestaShop
Medium
ghsa-3xgr-h5hq-7299
GeoIP processor disables SSL certificate validation when downloading databases
Medium
ghsa-28gg-8qqj-fhh5
OpenSearch Data Prepper uses deprecated SSL protocol identifier
Critical
CVE-2025-62410
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
High
CVE-2025-62371
OpenSearch Data Prepper plugins trust all SSL certificates by default
High
CVE-2025-62381
`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`
Low
CVE-2025-62380
Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails
Critical
CVE-2025-10850
Felan Framework <= 1.1.4 - Hardcoded Credentials
Medium
CVE-2025-10849
Felan Framework <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation/Deactivation via process_plugin_actions
Critical
CVE-2025-10742
Truelysell Core <= 1.8.6 - Unauthenticated Arbitrary User Password Change
High
CVE-2025-10706
Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
Medium
CVE-2025-55248
Microsoft Security Advisory CVE-2025-55248: .NET Information Disclosure Vulnerability
High
CVE-2025-55247
Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability
High
CVE-2025-59419
Netty has SMTP Command Injection Vulnerability that Allows Email Forgery
Medium
CVE-2025-10700
Ally - Web Accessibility & Usability <= 3.8.0 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-55039
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.
Low
CVE-2025-58972
Barcode Scanner with Inventory & Order Manager <= 1.10.4 - Authenticated (Shop Manager+) Directory Traversal
Critical
CVE-2025-6027
Ace User Management <= 2.0.3 - Unauthenticated Privilege Escalation via Password Reset
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.