Archive
December 2025
Vulnerabilities first published in this month (UTC), newest first.
153 results · Clear filters · Feed
-
High 8.8CVE-2025-14364 Public exploit
Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation
The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2.0.8. This m…
-
High 7.2
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the an…
KEV Feb 20, 2026 -
High 8.8CVE-2025-68434 Public exploit
opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Cross-Site Request Forgery (CSRF) vulnerability exists in the application's …
-
High 8.1CVE-2025-68147 Public exploit
opensourcepos has a Cross-site Scripting vulnerability
Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and prior to version 3.4.2, a Stored Cross-Site Scripting (XSS) vulnerability exists in the "Return Policy…
-
Critical 9.3CVE-2025-68400 Public exploit
ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed an…
-
Critical 9.1CVE-2025-68109 Public exploit
ChurchCRM vulnerable to RCE with database restore functionality
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently uploa…
-
Critical 9.3CVE-2025-67876 Public exploit
ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking
ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into grou…
-
High 8.5CVE-2025-67875 Public exploit
ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking
ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can i…
-
High 8.8
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 an…
KEV Dec 15, 2025 -
Medium 4.3
A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and i…
-
Medium 6.9CVE-2025-34442 Public exploit
AVideo < 20.1 System Path Disclosure via Public API
AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files, revealing underlying filesystem structure and facilitating more effective attack chains.
-
Medium 6.9CVE-2025-34441 Public exploit
AVideo < 20.1 User Information Disclosure via Public API
AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administrative status, and last login times, enabling user enumeration and privacy violations.
-
Critical 10.0CVE-2025-62521 Public exploit
ChurchCRM has unauthenticated RCE in its Install Wizard
ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation p…
-
Critical 10.0
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability
A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to execute arbitrary system commands on an affected device with root…
KEV Dec 17, 2025 -
Critical 9.9CVE-2025-14700 Public exploit
Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller
An input neutralization vulnerability in the Webhook Template component of Crafty Controller allows a remote, authenticated attacker to perform remote code execution via Server Side Template Injection.
-
Medium 6.6CVE-2025-65855 Public exploit
The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard…
-
High 8.8CVE-2025-14765 Public exploit
Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap…
-
Critical 9.8CVE-2025-46295 Public exploit
Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications pas…
-
Critical 9.0CVE-2025-33210 Public exploit
NVIDIA Isaac Lab contains a deserialization vulnerability. A successful exploit of this vulnerability might lead to cod…
-
High 8.9CVE-2025-68116 Public exploit
FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling
FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 2.7.1 are vulnerable to Stored Cross-Site Scripting (XSS) due to unsafe handling of browser-renderable user uploads when served through the sharing and download endpoints. An attack…
-
Critical 10.0
A remote code execution issue exists in HPE OneView.
KEV Jan 7, 2026 -
High 8.5CVE-2025-68055 Public exploit
WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.32.
-
Medium 6.5CVE-2025-65427 Public exploit
An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implem…
-
Critical 9.1CVE-2025-65318 Public exploit
When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system with…
-
Critical 9.8CVE-2025-14156 Public exploit
Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'
The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when creating new users via the `/fox-lms/v1/pa…
-
High 8.2CVE-2025-65742 Public exploit
An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers t…
-
High 8.8CVE-2025-14659 Public exploit
D-Link DIR-860LB1/DIR-868LB1 DHCP command injection
A vulnerability was detected in D-Link DIR-860LB1 and DIR-868LB1 203b01/203b03. Affected is an unknown function of the component DHCP Daemon. The manipulation of the argument Hostname results in command injection. It is possible to launch the attack remotely.…
-
Critical 9.8CVE-2025-14440 Public exploit
JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie
The JAY Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.4.01. This is due to incorrect authentication checking in the 'jay_login_register_process_switch_back' function with the 'jay_login_regist…
-
High 7.1
Gladinet CentreStack and TrioFox Hard Coded AES Keys
Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades security for public exposed endpoints that may make use of it and may offer arbitrary local file inclusio…
KEV Dec 15, 2025 -
Medium 5.5
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.2 and iPadOS 18.…
KEV Mar 20, 2026 -
Critical 9.8CVE-2024-58299 Public exploit
PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Command
PCMan FTP Server 2.0 contains a buffer overflow vulnerability in the 'pwd' command that allows remote attackers to execute arbitrary code. Attackers can send a specially crafted payload during the FTP login process to overwrite memory and potentially gain sys…
-
High 8.8
Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perfo…
KEV Dec 12, 2025 -
Medium 5.1CVE-2025-67730 Public exploit
Frappe authenticated users can execute XSS through form description fields
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to add malicious HTML and JavaScript through description fields in the Job, Course and Batch forms. This …
-
Medium 6.9CVE-2025-67727 Public exploit
Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management
Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access …
-
Medium 4.2CVE-2025-67780 Public exploit
SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via u…
-
Critical 9.3CVE-2024-58290 Public exploit
Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint
Xhibiter NFT Marketplace 1.10.2 contains a SQL injection vulnerability in the collections endpoint that allows attackers to manipulate database queries through the 'id' parameter. Attackers can exploit boolean-based, time-based, and UNION-based SQL injection …
-
Critical 9.3CVE-2024-58286 Public exploit
dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path
dizqueTV 1.5.3 contains a remote code execution vulnerability that allows attackers to inject arbitrary commands through the FFMPEG Executable Path settings. Attackers can modify the executable path with shell commands to read system files like /etc/passwd by…
-
Medium 5.3CVE-2025-64702 Public exploit
quic-go HTTP/3 QPACK Header Expansion DoS
quic-go is an implementation of the QUIC protocol in Go. Versions 0.56.0 and below are vulnerable to excessive memory allocation through quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large head…
-
High 7.5
Denial of Service Vulnerability in React Server Components
A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-d…
-
Medium 5.3
Source Code Exposure Vulnerability in React Server Components
An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-…