High
CVE-2025-60231
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,737
High
CVE-2025-53433
EasyEat <= 1.9.0 - Unauthenticated Local File Inclusion
High
CVE-2025-49943
Femme <= 1.3.11 - Unauthenticated Local File Inclusion
High
CVE-2025-60233
Zuut <= 1.4.2 - Unauthenticated PHP Object Injection
High
CVE-2025-53432
Echo <= 1.15.0 - Unauthenticated Local File Inclusion
High
CVE-2025-49941
GlamChic <= 1.0.11 - Unauthenticated Local File Inclusion
Medium
CVE-2025-27003
Quick Paypal Payments <= 5.7.46 - Cross-Site Request Forgery
High
CVE-2025-52768
Faith & Hope <= 2.13.0 - Unauthenticated Local File Inclusion
Critical
CVE-2025-58367
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
Medium
CVE-2025-9824
Mautic Vulnerable to User Enumeration via Response Timing
Medium
CVE-2025-9823
Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add
Medium
CVE-2025-9822
Mautic vulnerable to secret data extraction via elfinder
Low
CVE-2025-9821
Mautic vulnerable to SSRF via webhook function
High
CVE-2025-58362
Hono's flaw in URL path parsing could cause path confusion
Medium
CVE-2025-55305
Electron has ASAR Integrity Bypass via resource modification
High
CVE-2025-57833
Django is subject to SQL injection through its column aliases
High
CVE-2025-6085
Make Connector <= 1.5.10 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2025-9616
PopAd <= 1.0.4 - Cross-Site Request Forgery to Settings Update
High
ghsa-ph6w-f82w-28w6
Claude Code Vulnerable to Arbitrary Code Execution Due to Insufficient Startup Warning
Low
CVE-2025-58064
CKEditor 5 cross-site scripting (XSS) vulnerability in the clipboard package
Medium
CVE-2025-58057
Netty's decoders vulnerable to DoS via zip bomb style attack
Critical
CVE-2025-55748
XWiki configuration files can be accessed through jsx and sx endpoints
Critical
CVE-2025-55747
XWiki configuration files can be accessed through the webjars API
Medium
CVE-2025-58460
Jenkins OpenTelemetry Plugin missing permission check allows capturing credentials
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.