Medium
CVE-2025-43826
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Critical
CVE-2025-62023
s2Member <= 250905 - Unauthenticated Remote Code Execution
High
CVE-2025-58966
NEX-Forms LITE < 8.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-49380
WooCommerce Vehicle Parts Finder <= 3.7 - Unauthenticated PHP Object Injection
Medium
CVE-2025-5983
Meta Tag Manager <= 3.2 - Open Redirect
Medium
CVE-2025-43827
Liferay Portal Vulnerable to IDOR via audit events
Medium
CVE-2025-56200
validator.js has a URL validation bypass vulnerability in its isURL function
Medium
CVE-2025-55797
FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint
High
CVE-2025-56571
Finance.js vulnerable to DoS via the IRR function’s depth parameter
High
CVE-2025-56572
Finance.js vulnerable to DoS via the seekZero() parameter
Medium
CVE-2025-54476
Joomla! CMS vulnerable to XSS via the input filter
High
CVE-2025-15061
figma-developer-mcp vulnerable to command injection in get_figma_data tool
High
CVE-2025-11149
@nubosoftware/node-static failure to catch exception can result in server crash
Critical
CVE-2025-11148
check-branches is vulnerable to command Injection
Medium
CVE-2025-43817
Liferay Portal vulnerable to reflected cross-site scripting via the `redirect` parameter
Medium
CVE-2025-43813
Liferay Portal vulnerable to path traversal and denial-of-service in the ComboServlet
Medium
CVE-2025-43812
Liferay Portal vulnerable to cross-site scripting in the web content template
Medium
CVE-2025-43820
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Medium
CVE-2025-43818
Liferay Portal vulnerable to cross-site scripting in the Calendar widget
Medium
CVE-2025-43815
Liferay Portal vulnerable to reflected cross-site scripting on the page configuration page
Medium
CVE-2025-43811
Liferay Portal vulnerable to cross-site scripting in the related asset selector
Medium
CVE-2025-62916
Flights & Hotels Booking WP Plugin <= 3.1 - Missing Authorization
High
CVE-2025-58961
CF7 Auto Responder Addon <= 2.4 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-64251
Ultimate Learning Pro <= 3.9.3 - Authenticated (Instructor+) Arbitrary Content Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.