Archive

3 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /3 January 2026 →

All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

High 7.6

CVE-2025-65027 Public exploit

RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files…

rommapp romm

Dec 3, 2025
Medium 5.3

CVE-2025-20384 Public exploit

Unauthenticated Log Injection in Splunk Enterprise

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.4, 10.0.2503.6, and 9.3.2411.117.125, an unauthenticated attacker can inject American National Standards Institute (ANSI) escape codes int…

Splunk Splunk Enterprise Splunk Cloud Platform

Dec 3, 2025
Critical 10.0

CVE-2025-55182 Exploited · Ransomware Public exploit Scanner template EPSS 100%

React Server Components are Vulnerable to RCE

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vul…

Meta react-server-dom-parcel react-server-dom-turbopack react-server-dom-webpack npm

Dec 3, 2025
KEV Dec 5, 2025
Critical 10.0

CVE-2025-13390 Public exploit Scanner template

WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.4 due to incorrect implementation of the authentication algorithm in the "wdk_generate_auto_login_link" function. This is due to the fea…

listingthemes WP Directory Kit Web / CMS

Dec 3, 2025
Medium 6.4

CVE-2025-13401 Public exploit

Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in…

optimizingmatters Autoptimize Web / CMS

Dec 3, 2025
Critical 9.8

CVE-2025-13342 Public exploit Scanner template

Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in all versions up to, and including, 3.28.20. This is due to insufficient capability checks and input validation in the ActionOpti…

shabti Frontend Admin by DynamiApps Web / CMS

Dec 3, 2025
High 7.4

CVE-2025-13947 Public exploit

Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations orig…

Red Hat The WebKitGTK Team Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu

Dec 3, 2025
High 8.8

CVE-2025-12744 Public exploit

Abrt: command-injection in abrt leading to local privilege escalation

A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command (docker inspect %s) without proper validation. An unprivileged local user c…

Red Hat Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6 Linux

Dec 3, 2025
Critical 9.8

CVE-2025-13486 Public exploit Scanner template EPSS 69%

Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. This is due to the function accepting user input and then passing that through call_user_func…

hwk-fr Advanced Custom Fields: Extended Web / CMS

Dec 3, 2025
Medium 5.3

CVE-2025-12585 Public exploit

MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames. This makes it possible for unauthenticated attackers to extract session values that ca…

mxchat MxChat – AI Chatbot & Content Generation for WordPress Web / CMS

Dec 3, 2025
High 8.4

CVE-2025-50360 Public exploit

A heap buffer overflow in compiler.c and compiler.h in Pepper language 0.1.1commit 961a5d9988c5986d563310275adad3fd181b…

Dec 3, 2025
Medium 5.1

CVE-2025-50361 Public exploit

Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36…

Dec 3, 2025
High 8.8

CVE-2025-57199 Public exploit

AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command inje…

Dec 3, 2025
Medium 6.5

CVE-2025-65345 Public exploit

alexusmai laravel-file-manager is vulnerable to Directory Traversal

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives containing files and directories outside the intended scope due to improper path validation.

alexusmai/laravel-file-manager Packagist

Dec 3, 2025
High 7.5

CVE-2025-65320 Public exploit

Abacre Restaurant Point of Sale (POS) up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in…

Dec 3, 2025