Critical
CVE-2025-10690
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,690
Critical
CVE-2025-54994
@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API
Critical
CVE-2025-57285
CodeceptJS's incomprehensive sanitation can lead to Command Injection
High
CVE-2025-56265
N8N's Chat Trigger component is vulnerable to XSS
Medium
CVE-2025-10097
SimStudioAI: A function in route.ts is vulnerable to Code Injection
High
CVE-2025-9539
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation
Medium
CVE-2025-9542
AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions
Medium
CVE-2025-9061
Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-9058
Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-9489
WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names
Medium
CVE-2019-25225
sanitize-html is vulnerable to XSS through incomprehensive sanitization
Medium
CVE-2025-58782
Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data
Critical
CVE-2025-9114
Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change
Critical
CVE-2025-9113
Doccure Core <= 1.5.3 - Unauthenticated Arbitrary File Upload
High
CVE-2025-9112
Doccure <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-59004
WC Return products <= 1.5 - Reflected Cross-Site Scripting
Medium
CVE-2024-5200
Postie <= 1.9.70 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-59005
Categorify <= 1.0.7.5 - Missing Authorization
Medium
CVE-2025-59008
ZIP Code Based Content Protection <= 1.0.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-59006
Easy Woocommerce Customizer <= 1.0.2 - Reflected Cross-Site Scripting
High
CVE-2025-60213
Scape <= 1.5.13 - Unauthenticated PHP Object Injection
High
CVE-2025-53238
Toast Mobile Menu <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-59010
Permalink Manager Lite <= 2.5.1.3 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-53234
UDesign Core <= 4.14.0 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.