Skip to content
OpenAdvisories

Archive

25 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /25 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-14913

    Frontend Post Submission Manager Lite <= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion

    The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to an incorrect authorization check on the 'media_delete_action' function in all versions up to, and including, 1…

    WP Shuffle Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin Web / CMS
  • Medium 6.3
    CVE-2025-15088

    ketr JEPaaS loadPostil postilService.loadPostils sql injection

    A vulnerability was detected in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is the function postilService.loadPostils of the file /je/postil/postil/loadPostil. Performing a manipulation of the argument keyWord results in sql injection. Remote expl…

    ketr JEPaaS
  • Medium 4.3
    CVE-2025-15087

    youlaitech youlai-mall OrderController.java submitOrderPayment improper authorization

    A security vulnerability has been detected in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function submitOrderPayment of the file mall-oms/oms-boot/src/main/java/com/youlai/mall/oms/controller/app/OrderController.java. Such manipulation of the argumen…

    youlaitech youlai-mall
  • Medium 4.3
    CVE-2025-15086

    youlaitech youlai-mall MemberController.java getMemberByMobile access control

    A weakness has been identified in youlaitech youlai-mall 1.0.0/2.0.0. This impacts the function getMemberByMobile of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java. This manipulation causes improper access co…

    youlaitech youlai-mall
  • Medium 6.4
    CVE-2025-68936

    ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. This is related to DocumentServer.

    ONLYOFFICE Document Server
  • Medium 6.4
    CVE-2025-68935

    ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. This is related to …

    ONLYOFFICE Document Server
  • Medium 4.3
    CVE-2025-15085

    youlaitech youlai-mall Balance MemberController.java deductBalance improper authorization

    A security flaw has been discovered in youlaitech youlai-mall 1.0.0/2.0.0. This affects the function deductBalance of the file mall-ums/ums-boot/src/main/java/com/youlai/mall/ums/controller/app/MemberController.java of the component Balance Handler. The manip…

    youlaitech youlai-mall
  • Medium 5.3
    CVE-2025-15082

    TOZED ZLT M30s Web Management proc_post information disclosure

    A vulnerability was found in TOZED ZLT M30s up to 1.47. Impacted is an unknown function of the file /reqproc/proc_post of the component Web Management Interface. Performing manipulation of the argument goformId results in information disclosure. It is possibl…

    TOZED ZLT M30S
  • Medium 6.3
    CVE-2025-15081

    JD Cloud BE6500 jdcapi sub_4780 command injection

    A vulnerability has been found in JD Cloud BE6500 4.4.1.r4308. This issue affects the function sub_4780 of the file /jdcapi. Such manipulation of the argument ddns_name leads to command injection. The attack may be performed from remote. The exploit has been …

    JD Cloud BE6500
  • Medium 5.9
    CVE-2025-66378

    Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attack…

    Pexip Infinity
  • Medium 5.9
    CVE-2025-49088

    Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Joi…

    Pexip Infinity