Medium
CVE-2025-0763
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,687
Medium
CVE-2025-43786
Liferay Portal exposes ERC which can lead to exploit the time response attack
Medium
CVE-2025-43781
Liferay Portal is vulnerable to XSS attack through its search bar portlet
Medium
CVE-2025-43775
Liferay Portal is vulnerable to XSS attacks via its remote app title field
Medium
CVE-2025-58759
TinyEnv: Inline comments not stripped properly in .env values
Medium
CVE-2025-58758
TinyEnv: Missing .env file not required — may cause unexpected behavior
Low
CVE-2025-58751
Vite middleware may serve files starting with the same name with the public directory
Low
CVE-2025-58752
Vite's `server.fs` settings were not applied to HTML files
High
CVE-2025-58449
Maho is Vulnerable to Authenticated Remote Code Execution via File Upload
High
CVE-2025-58451
Cattown is Vulnerable to Uncontrolled Resource Consumption through Inefficient Regular Expression Complexity
Medium
CVE-2025-57665
Element Plus Link component (el-link) implements insufficient input validation for the href attribute
High
CVE-2024-43115
Apache DolphinScheduler vulnerable to Alert Script Attack
Medium
CVE-2025-9367
Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting
High
CVE-2025-10049
Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2025-10142
PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection
Medium
CVE-2025-9463
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by Parameter
Medium
CVE-2025-8778
NitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax Function
High
CVE-2025-10040
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure
Medium
CVE-2025-9622
WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing
Medium
CVE-2025-10126
MyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9857
Heateor Login – Social Login Plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-7049
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
High
CVE-2025-7718
Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover
Medium
CVE-2025-7843
Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.