Skip to content
OpenAdvisories

Archive

20 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /20 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.3
    CVE-2025-14989

    Campcodes Complete Online Beauty Parlor Management System search-invoices.php sql injection

    A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/search-invoices.php. Such manipulation leads to sql injection. The attack can be launched remotely. …

    Campcodes Complete Online Beauty Parlor Management System
  • High 8.5
    CVE-2025-34290

    Versa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation

    Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file s…

    Versa SASE Client for Windows Windows
  • High 7.6
    CVE-2025-7782

    WP JobHunt <= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status'

    The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cs_update_application_status_callback' function in all versions up to, and including, 7.7. This make…

    Web / CMS
  • High 8.7
    CVE-2025-14300

    Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425

    The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5  exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in …

    TP-Link Systems Tapo C100 v5 Tapo C200 Tapo C425 v1.2 Network devices
  • High 7.1
    CVE-2025-14299

    Improper Content-Length Validation in HTTPS Requests on Tapo C200

    The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation,…

    TP-Link Systems Tapo C200 v3 Network devices
  • High 8.7
    CVE-2025-8065

    Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS

    A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack b…

    TP-Link Systems Tapo C520WS v2.6 Tapo C200 v3 Network devices