Skip to content
OpenAdvisories

Archive

17 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /17 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 8.8
    CVE-2025-68434 Public exploit

    opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation

    Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's …

    opensourcepos opensourcepos
  • High 8.1
    CVE-2025-68147 Public exploit

    opensourcepos has a Cross-site Scripting vulnerability

    Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists in the "Return Policy…

    opensourcepos opensourcepos
  • Critical 9.3
    CVE-2025-68400 Public exploit

    ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

    ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed an…

    ChurchCRM CRM
  • Critical 9.1
    CVE-2025-68109 Public exploit

    ChurchCRM vulnerable to RCE with database restore functionality

    ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently uploa…

    ChurchCRM CRM
  • Critical 9.3
    CVE-2025-67876 Public exploit

    ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking

    ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into grou…

    ChurchCRM CRM
  • High 8.5
    CVE-2025-67875 Public exploit

    ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking

    ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can i…

    ChurchCRM CRM
  • High 8.8
    CVE-2025-43529 Exploited Public exploit EPSS 26%

    A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 an…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu
    KEV Dec 15, 2025
  • Medium 4.3
    CVE-2025-43541 Public exploit EPSS 34%

    A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and i…

    Apple macOS iOS and iPadOS visionOS macOS iOS Browsers Debian Ubuntu
  • Medium 6.9
    CVE-2025-34442 Public exploit

    AVideo < 20.1 System Path Disclosure via Public API

    AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.

    World Wide Broadcast Network AVideo
  • Medium 6.9
    CVE-2025-34441 Public exploit

    AVideo < 20.1 User Information Disclosure via Public API

    AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.

    World Wide Broadcast Network AVideo
  • Critical 10.0
    CVE-2025-62521 Public exploit

    ChurchCRM has unauthenticated RCE in its Install Wizard

    ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation p…

    ChurchCRM CRM
  • Critical 10.0
    CVE-2025-20393 Exploited Public exploit EPSS 32%

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

    A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root…

    Cisco Cisco Secure Email Cisco Secure Email and Web Manager Network devices
    KEV Dec 17, 2025
  • Critical 9.9
    CVE-2025-14700 Public exploit

    Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

    An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.

    Arcadia Technology Crafty Controller
  • Medium 6.6
    CVE-2025-65855 Public exploit

    The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard…