# CVEs published 2025-12-05

145 CVEs were published on December 5, 2025: 7 critical, 38 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-66629](https://cve.now/CVE-2025-66629.md): HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF (CVSS 3.7, hedgedoc)
- [CVE-2025-14116](https://cve.now/CVE-2025-14116.md): xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery (CVSS 5.1, xerrors Yuxi-Know)
- [CVE-2025-14111](https://cve.now/CVE-2025-14111.md): Rarlab RAR App com.rarlab.rar path traversal (CVSS 2.3, Rarlab RAR App)
- [CVE-2025-34291](https://cve.now/CVE-2025-34291.md): Langflow \<= 1.6.9 CORS Misconfiguration to Token Hijack & RCE (CVSS 9.4, KEV, Langflow)
- [CVE-2025-14108](https://cve.now/CVE-2025-14108.md): ZSPACE Q2C NAS HTTP POST Request open zfilev2\_api.OpenSafe command injection (CVSS 8.7, ZSPACE Q2C NAS)
- [CVE-2025-14107](https://cve.now/CVE-2025-14107.md): ZSPACE Q2C NAS HTTP POST Request status zfilev2\_api.SafeStatus command injection (CVSS 8.7, ZSPACE Q2C NAS)
- [CVE-2025-14106](https://cve.now/CVE-2025-14106.md): ZSPACE Q2C NAS HTTP POST Request close zfilev2\_api.CloseSafe command injection (CVSS 8.7, ZSPACE Q2C NAS)
- [CVE-2025-13426](https://cve.now/CVE-2025-13426.md): Improper Sandboxing in Google Apigee's JavaCallout Policy Allows for Remote Code Execution (CVSS 8.7, Google Cloud Apigee hybrid Javacallout policy)
- [CVE-2025-14105](https://cve.now/CVE-2025-14105.md): TOZED ZLT M30S/ZLT M30S PRO Web proc\_post denial of service (CVSS 5.3, TOZED ZLT M30S)
- [CVE-2025-8148](https://cve.now/CVE-2025-8148.md): CVE-2025-8148 Improper Access Control in SFTP service of GoAnywhere MFT (CVSS 4.2, Fortra GoAnywhere MFT)
- [CVE-2025-46603](https://cve.now/CVE-2025-46603.md): Dell CloudBoost Virtual Appliance, versions 19.13.0.0 and prior, contains an Improper Restriction of Excessive Authentication Attempts vulne (CVSS 7.0, Dell CloudBoost Virtual Appliance)
- [CVE-2025-66624](https://cve.now/CVE-2025-66624.md): BACnet-stack MS/TP reply matcher OOB read (CVSS 7.5, bacnet-stack)
- [CVE-2025-66623](https://cve.now/CVE-2025-66623.md): Strimzi allows unrestricted access to all Secrets in the same Kubernetes namespace from Kafka Connect and MirrorMaker 2 operands (CVSS 7.4, strimzi-kafka-operator · io.strimzi:strimzi)
- [CVE-2025-66581](https://cve.now/CVE-2025-66581.md): Frappe LMS is Missing Server-Side Authorization in Business Logic (CVSS 1.3, frappe lms)
- [CVE-2025-66577](https://cve.now/CVE-2025-66577.md): cpp-httplib Untrusted HTTP Header Handling: X-Forwarded-For/X-Real-IP Trust (CVSS 5.3, yhirose cpp-httplib)
- [CVE-2025-66570](https://cve.now/CVE-2025-66570.md): cpp-httplib Untrusted HTTP Header Handling: Internal Header Shadowing (REMOTE\*/LOCAL\*) (CVSS 10.0, yhirose cpp-httplib)
- [CVE-2025-66566](https://cve.now/CVE-2025-66566.md): yawkat LZ4 Java has a possible information leak in Java safe decompressor (CVSS 8.2, yawkat lz4-java · at.yawk.lz4:lz4-java +3)
- [CVE-2025-66562](https://cve.now/CVE-2025-66562.md): TUUI vulnerable to Remote Code Execution (RCE) via XSS in Markdown ECharts Rendering (CVSS 8.9, AI-QL tuui)
- [CVE-2025-66558](https://cve.now/CVE-2025-66558.md): Nextcloud Twofactor WebAuthn app was updated based on public key (CVSS 3.1, nextcloud security-advisories)
- [CVE-2025-66556](https://cve.now/CVE-2025-66556.md): Nextcloud talk allows participants to blindly delete poll drafts of other users by ID (CVSS 3.5, nextcloud security-advisories)
- [CVE-2025-66554](https://cve.now/CVE-2025-66554.md): Nextcloud Contacts vulnerable to Stored XSS in contacts app via organisation and title field (CVSS 3.5, nextcloud security-advisories)
- [CVE-2025-66549](https://cve.now/CVE-2025-66549.md): Nextcloud Desktop discloses information when attempting to lock a file inside a end-to-end encrypted directory (CVSS 2.4, nextcloud security-advisories)
- [CVE-2025-66545](https://cve.now/CVE-2025-66545.md): Nextcloud Groupfolders users with read-only permissions for team folder can restore deleted files from trash bin (CVSS 3.5, nextcloud security-advisories)
- [CVE-2025-66515](https://cve.now/CVE-2025-66515.md): Nextcloud Approval app allows users to request approval for other users file (CVSS 2.7, nextcloud security-advisories)
- [CVE-2020-36882](https://cve.now/CVE-2020-36882.md): Flexsense DiskBoss Application Crash Denial of Service (CVSS 8.7, Flexsense DiskBoss)
- [CVE-2025-66514](https://cve.now/CVE-2025-66514.md): Nextcloud Mail stored HTML injection in subject text (CVSS 3.5, nextcloud security-advisories)
- [CVE-2025-66557](https://cve.now/CVE-2025-66557.md): Nextcloud Deck app allowed user with "Can share" permission to modify permissions of other non-owners (CVSS 5.4, nextcloud security-advisories)
- [CVE-2025-66548](https://cve.now/CVE-2025-66548.md): Nextcloud Deck app allows to spoof file extensions by using RTLO characters (CVSS 3.3, nextcloud security-advisories)
- [CVE-2020-36881](https://cve.now/CVE-2020-36881.md): Flexsense DiskBoss 'Add Input Directory' Buffer Overflow (CVSS 8.6, Flexsense DiskBoss)
- [CVE-2020-36880](https://cve.now/CVE-2020-36880.md): Flexsense DiskBoss 'Reports and Data Directory' Buffer Overflow (CVSS 8.6, Flexsense DiskBoss)
- [CVE-2025-34256](https://cve.now/CVE-2025-34256.md): Advantech WISE-DeviceOn Server \< 5.4 Hard-coded JWT Key Authentication Bypass (CVSS 10.0, Advantech Co. WISE-DeviceOn Server)
- [CVE-2025-34265](https://cve.now/CVE-2025-34265.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via rule-engines (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2025-66553](https://cve.now/CVE-2025-66553.md): Nextcloud Tables app allowed users to view columns metadata information of any table (CVSS 4.3, nextcloud security-advisories)
- [CVE-2020-36879](https://cve.now/CVE-2020-36879.md): Flexsense DiskBoss Service Unquoted Service Path Vulnerability (CVSS 8.5, Flexsense DiskBoss)
- [CVE-2025-34263](https://cve.now/CVE-2025-34263.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via plugin-config/dashboards/menus (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2020-36878](https://cve.now/CVE-2020-36878.md): ReQuest Serious Play F3 Media Player \<= 3.0.0 Directory Traversal File Disclosure (CVSS 8.7, ReQuest Serious Play Media Player)
- [CVE-2025-34266](https://cve.now/CVE-2025-34266.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via plugin-config/addins/menus (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2025-34264](https://cve.now/CVE-2025-34264.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via dog/{agentId} (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2025-34262](https://cve.now/CVE-2025-34262.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via devices/name/{agent\_id} (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2020-36877](https://cve.now/CVE-2020-36877.md): ReQuest Serious Play F3 Media Server \<= 7.0.3 code execution (CVSS 9.3, ReQuest Serious Play Pro · ReQuest Serious Play)
- [CVE-2025-34258](https://cve.now/CVE-2025-34258.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via devicemap/plan (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2025-34259](https://cve.now/CVE-2025-34259.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via devicemap/building (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2025-34261](https://cve.now/CVE-2025-34261.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via devicegroups/ (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2025-34260](https://cve.now/CVE-2025-34260.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via action/schedule (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2025-34257](https://cve.now/CVE-2025-34257.md): Advantech WISE-DeviceOn Server \< 5.4 Authenticated Stored XSS via action/defined (CVSS 5.1, Advantech Co. WISE-DeviceOn Server)
- [CVE-2025-66551](https://cve.now/CVE-2025-66551.md): Nextcloud Tables is missing an ownership check which allows moving columns into tables of other users (CVSS 6.3, nextcloud security-advisories)
- [CVE-2020-36876](https://cve.now/CVE-2020-36876.md): ReQuest Serious Play F3 Media Server \<= 7.0.3 Debug Log Disclosure2020 (CVSS 8.7, ReQuest Serious Play Pro · ReQuest Serious Play)
- [CVE-2025-66513](https://cve.now/CVE-2025-66513.md): Nextcloud Tables app share information not limited to relevant users (CVSS 4.3, nextcloud security-advisories)
- [CVE-2025-14094](https://cve.now/CVE-2025-14094.md): Edimax BR-6478AC V3 formSysCmd sub\_44CCE4 os command injection (CVSS 5.1, Edimax BR-6478AC)
- [CVE-2025-66550](https://cve.now/CVE-2025-66550.md): Nextcloud Calendar attachments of local files are offered to downloaded (CVSS 5.7, nextcloud security-advisories)
- [CVE-2025-66546](https://cve.now/CVE-2025-66546.md): Nextcloud Calendar app allowed booking appointments without the generated token (CVSS 3.3, nextcloud security-advisories)
- [CVE-2025-66511](https://cve.now/CVE-2025-66511.md): Nextcloud Calendar app used predictable proposal participant tokens (CVSS 4.8, nextcloud security-advisories)
- [CVE-2025-66552](https://cve.now/CVE-2025-66552.md): Nextcloud Server admin\_audit does not log all actions on files in groupfolders (CVSS 4.3, nextcloud security-advisories)
- [CVE-2024-9183](https://cve.now/CVE-2024-9183.md): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (CVSS 7.7, GitLab)
- [CVE-2025-66547](https://cve.now/CVE-2025-66547.md): Nextcloud Server users can modify tags on files that do not belong to them (CVSS 4.3, nextcloud security-advisories)
- [CVE-2025-14093](https://cve.now/CVE-2025-14093.md): Edimax BR-6478AC V3 formTracerouteDiagnosticRun sub\_416990 os command injection (CVSS 5.1, Edimax BR-6478AC)
- [CVE-2025-66512](https://cve.now/CVE-2025-66512.md): Nextcloud Server vulnerable to XSS in SVG images when opened outside of Nextcloud (CVSS 5.4, nextcloud security-advisories)
- [CVE-2025-14104](https://cve.now/CVE-2025-14104.md): Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames (CVSS 6.1, util-linux · Red Hat Enterprise Linux +6)
- [CVE-2025-66510](https://cve.now/CVE-2025-66510.md): Nextcloud Server Contacts Search allowed users to retrieve contact information of other users beyond their contact list (CVSS 4.5, nextcloud security-advisories)
- [CVE-2025-65036](https://cve.now/CVE-2025-65036.md): XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro (CVSS 8.3, xwikisas xwiki-pro-macros)
- [CVE-2025-66471](https://cve.now/CVE-2025-66471.md): urllib3 Streaming API improperly handles highly compressed data (CVSS 8.9, urllib3)
- [CVE-2025-66418](https://cve.now/CVE-2025-66418.md): urllib3 allows an unbounded number of links in the decompression chain (CVSS 8.9, urllib3)
- [CVE-2025-14092](https://cve.now/CVE-2025-14092.md): Edimax BR-6478AC V3 formDebugDiagnosticRun sub\_416898 os command injection (CVSS 5.1, Edimax BR-6478AC)
- [CVE-2025-14091](https://cve.now/CVE-2025-14091.md): TrippWasTaken PHP-Guitar-Shop Product Details product.php sql injection (CVSS 6.9, TrippWasTaken PHP-Guitar-Shop)
- [CVE-2025-14090](https://cve.now/CVE-2025-14090.md): AMTT Hotel Broadband Operation System cardmake\_down.php sql injection (CVSS 5.1, AMTT Hotel Broadband Operation System)
- [CVE-2025-14089](https://cve.now/CVE-2025-14089.md): Himool ERP AdminActionViewSet update\_account improper authorization (CVSS 5.3, Himool ERP)
- [CVE-2025-14088](https://cve.now/CVE-2025-14088.md): ketr JEPaaS load improper authorization (CVSS 5.3, ketr JEPaaS)
- [CVE-2025-14086](https://cve.now/CVE-2025-14086.md): youlaitech youlai-mall openid access control (CVSS 5.3, youlaitech youlai-mall)
- [CVE-2025-14085](https://cve.now/CVE-2025-14085.md): youlaitech youlai-mall orders improper control of dynamically-identified variables (CVSS 5.3, youlaitech youlai-mall)
- [CVE-2025-58098](https://cve.now/CVE-2025-58098.md): Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVSS 8.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-6966](https://cve.now/CVE-2025-6966.md): Null-pointer dereference in python-apt TagSection.keys() (CVSS 6.9, Canonical python-apt)
- [CVE-2025-13654](https://cve.now/CVE-2025-13654.md): CVE-2025-13654 (CVSS 7.5, Duc)
- [CVE-2025-66200](https://cve.now/CVE-2025-66200.md): Apache HTTP Server: mod\_userdir+suexec bypass via AllowOverride FileInfo (CVSS 5.4, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-13620](https://cve.now/CVE-2025-13620.md): Wp Social Login and Register Social Counter \<= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering (CVSS 5.3, roxnor Wp Social Login and Register Social Counter)
- [CVE-2025-65082](https://cve.now/CVE-2025-65082.md): Apache HTTP Server: CGI environment variable override (CVSS 6.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-59775](https://cve.now/CVE-2025-59775.md): Apache HTTP Server: NTLM Leakage on Windows through UNC SSRF (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-55753](https://cve.now/CVE-2025-55753.md): Apache HTTP Server: mod\_md (ACME), unintended retry intervals (CVSS 7.5, Apache Software Foundation Apache HTTP Server)
- [CVE-2025-13682](https://cve.now/CVE-2025-13682.md): Trail Manager \<= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, phegman Trail Manager)
- [CVE-2025-13614](https://cve.now/CVE-2025-13614.md): Cool Tag Cloud \<= 2.29 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 8.1, wpkube Cool Tag Cloud)
- [CVE-2025-13678](https://cve.now/CVE-2025-13678.md): Thai Lottery Widget \<= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, siamlottery Thai Lottery Widget)
- [CVE-2025-12876](https://cve.now/CVE-2025-12876.md): Projectopia – WordPress Project Management \<= 5.1.19 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion (CVSS 5.3, Projectopia – Project Management Tool)
- [CVE-2025-12879](https://cve.now/CVE-2025-12879.md): User Generator and Importer \<= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation (CVSS 8.8, vinoth06 User Generator and Importer)
- [CVE-2025-13739](https://cve.now/CVE-2025-13739.md): CryptX \<= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, d3395 CryptX)
- [CVE-2025-12851](https://cve.now/CVE-2025-12851.md): My auctions allegro \<= 3.6.32 - Unauthenticated Local File Inclusion via controller (CVSS 8.1, wphocus My auctions allegro)
- [CVE-2025-12130](https://cve.now/CVE-2025-12130.md): WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors \<= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion (CVSS 4.3, wcvendors WC Vendors – WooCommerce Multivendor, WooCommerce…)
- [CVE-2025-13684](https://cve.now/CVE-2025-13684.md): ARK Related Posts \<= 2.19 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, alexkar ARK Related Posts)
- [CVE-2025-12850](https://cve.now/CVE-2025-12850.md): My auctions allegro \<= 3.6.32 - Unauthenticated SQL Injection via auction\_id (CVSS 7.5, wphocus My auctions allegro)
- [CVE-2025-13515](https://cve.now/CVE-2025-13515.md): Nouri.sh Newsletter \<= 1.0.1.3 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, danrajkumar Nouri.sh Newsletter)
- [CVE-2025-12093](https://cve.now/CVE-2025-12093.md): Voidek Employee Portal \<= 1.0.7 - Missing Authorization (CVSS 5.3, Voidek Employee Portal)
- [CVE-2025-12355](https://cve.now/CVE-2025-12355.md): Payaza \<= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update (CVSS 5.3, bigmaster Payaza)
- [CVE-2025-12374](https://cve.now/CVE-2025-12374.md): Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification \<= 2.0.44 - Authentication Bypass to Account Takeover (CVSS 9.8, User Verification by PickPlugins)
- [CVE-2025-12354](https://cve.now/CVE-2025-12354.md): Live CSS Preview \<= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, dojodigital Live CSS Preview)
- [CVE-2025-12373](https://cve.now/CVE-2025-12373.md): Torod – The smart shipping and delivery portal for e-shops and retailers \<= 1.9 - Cross-Site Request Forgery To Plugin's Settings Modification (CVSS 4.3, Torod – The smart shipping and delivery portal for e-shops…)
- [CVE-2025-12186](https://cve.now/CVE-2025-12186.md): Weekly Planner \<= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, michael\_j\_reid Weekly Planner)
- [CVE-2025-13528](https://cve.now/CVE-2025-13528.md): Feedback Modal for Website \<= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export\_data' Parameter (CVSS 5.3, nedwp Feedback Modal for Website)
- [CVE-2025-13860](https://cve.now/CVE-2025-13860.md): Easy Jump Links Menus \<= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, webradykal Easy Jump Links Menus)
- [CVE-2025-12154](https://cve.now/CVE-2025-12154.md): Auto Thumbnailer \<= 1.0 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, moderntribe Auto Thumbnailer)
- [CVE-2025-12190](https://cve.now/CVE-2025-12190.md): Image Optimizer by wps.sk \<= 1.2.0 - Cross-Site Request Forgery to Bulk Image Optimization (CVSS 4.3, duddi Image Optimizer by wps.sk)
- [CVE-2025-12191](https://cve.now/CVE-2025-12191.md): PDF Catalog for WooCommerce \<= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4, ovologics PDF Catalog for WooCommerce)
- [CVE-2025-12189](https://cve.now/CVE-2025-12189.md): Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents \<= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 4.3, breadbutter Bread & Butter: AI-Powered Lead Intelligence)
- [CVE-2025-12128](https://cve.now/CVE-2025-12128.md): Hide Categories Or Products On Shop Page \<= 1.0.7 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, kaushikankrani Hide Categories Or Products On Shop Page)
- [CVE-2025-12133](https://cve.now/CVE-2025-12133.md): EPROLO Dropshipping \<= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Tracking Data Modification (CVSS 4.3, paulepro2019 EPROLO-Dropshipping)
- [CVE-2025-12370](https://cve.now/CVE-2025-12370.md): Takeads \<= 1.0.13 - Missing Authorization to Plugin Settings Deletion (CVSS 4.3, Takeads)
- [CVE-2025-12153](https://cve.now/CVE-2025-12153.md): Featured Image via URL \<= 0.1 - Authenticated (Contributor+) Arbitrary FIle Upload (CVSS 8.8, tsaiid Featured Image via URL)
- [CVE-2025-13623](https://cve.now/CVE-2025-13623.md): Twitscription \<= 0.1.1 - Reflected Cross-Site Scripting via admin.php PATH\_INFO (CVSS 6.1, natambu Twitscription)
- [CVE-2025-13622](https://cve.now/CVE-2025-13622.md): Jabbernotification \<= 0.99-RC2 - Reflected Cross-Site Scripting via admin.php PATH\_INFO (CVSS 6.1, missi Jabbernotification)
- [CVE-2025-10055](https://cve.now/CVE-2025-10055.md): Time Sheets \<= 2.1.3 - Cross-Site Request Forgery (CVSS 4.3, mrdenny Time Sheets)
- [CVE-2025-12181](https://cve.now/CVE-2025-12181.md): ContentStudio \<= 1.3.7 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, ContentStudio)
- [CVE-2025-13625](https://cve.now/CVE-2025-13625.md): WP-SOS-Donate Donation Sidebar Plugin \<= 0.9.2 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, switch2mac WP-SOS-Donate Donation Sidebar Plugin)
- [CVE-2025-13360](https://cve.now/CVE-2025-13360.md): Quantic Social Image Hover \<= 1.0.8 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, monkeyboz Quantic Social Image Hover)
- [CVE-2025-12368](https://cve.now/CVE-2025-12368.md): Sermon Manager \<= 2.30.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpforchurch Sermon Manager)
- [CVE-2025-13621](https://cve.now/CVE-2025-13621.md): dream gallery \<= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action (CVSS 6.1, teamdream dream gallery)
- [CVE-2025-12165](https://cve.now/CVE-2025-12165.md): Webcake – Landing Page Builder \<= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, huyme Webcake – Landing Page Builder)
- [CVE-2025-12163](https://cve.now/CVE-2025-12163.md): Omnipress \<= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, omnipressteam Omnipress)
- [CVE-2025-13512](https://cve.now/CVE-2025-13512.md): CoSign Single Signon \<= 0.3.1 - Reflected Cross-Site Scripting via $\_SERVER\['PHP\_SELF'\] (CVSS 6.1, jiangxin CoSign Single Signon)
- [CVE-2025-12124](https://cve.now/CVE-2025-12124.md): FitVids for WordPress \<= 4.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, kevindees FitVids for WordPress)
- [CVE-2025-13144](https://cve.now/CVE-2025-13144.md): ContentStudio \<= 1.3.7 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, ContentStudio)
- [CVE-2025-13312](https://cve.now/CVE-2025-13312.md): CRM Memberships \<= 2.5 - Missing Authorization to Unauthenticated 'ntzcrm\_add\_new\_tag' AJAX Action (CVSS 5.3, dripadmin CRM Memberships)
- [CVE-2025-13006](https://cve.now/CVE-2025-13006.md): SurveyFunnel – Survey Plugin for WordPress \<= 1.1.5 - Unauthenticated Information Exposure (CVSS 5.3, wpeka-club SurveyFunnel – Survey Plugin for WordPress)
- [CVE-2025-13313](https://cve.now/CVE-2025-13313.md): CRM Memberships \<= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm\_changepassword' AJAX Endpoint (CVSS 9.8, dripadmin CRM Memberships)
- [CVE-2025-13362](https://cve.now/CVE-2025-13362.md): Norby AI \<= 1.0.3 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, jevgenisultanov Norby AI)
- [CVE-2025-13494](https://cve.now/CVE-2025-13494.md): SSP Debug \<= 1.0.0 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, jimmyredline80 SSP Debug)
- [CVE-2025-12417](https://cve.now/CVE-2025-12417.md): SurveyFunnel – Survey Plugin for WordPress \<= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpeka-club SurveyFunnel – Survey Plugin for WordPress)
- [CVE-2025-13066](https://cve.now/CVE-2025-13066.md): Demo Importer Plus \<= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass (CVSS 8.8, kraftplugins Demo Importer Plus)
- [CVE-2025-27389](https://cve.now/CVE-2025-27389.md): Application Installation Source Verification Flaw May Lead to Risk Detection Bypass (CVSS 5.1, ColorOS)
- [CVE-2025-12804](https://cve.now/CVE-2025-12804.md): Booking Calendar \<= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode (CVSS 6.4, wpdevelop Booking Calendar)
- [CVE-2025-11759](https://cve.now/CVE-2025-11759.md): Backup, Restore and Migrate your sites with XCloner \<= 4.8.2 - Cross-Site Request Forgery in Xcloner\_Remote\_Storage:save() (CVSS 4.3, watchful Backup, Restore and Migrate your sites with XCloner)
- [CVE-2025-62223](https://cve.now/CVE-2025-62223.md): Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2025-14052](https://cve.now/CVE-2025-14052.md): youlaitech youlai-mall members getMemberById access control (CVSS 5.3, youlaitech youlai-mall)
- [CVE-2016-20023](https://cve.now/CVE-2016-20023.md): In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file w (CVSS 5.0, CKSource CKFinder)
- [CVE-2025-32898](https://cve.now/CVE-2025-32898.md): The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks. (CVSS 4.7, KDE Connect verification-code protocol)
- [CVE-2025-32899](https://cve.now/CVE-2025-32899.md): In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair. (CVSS 4.3, KDEConnect)
- [CVE-2025-32900](https://cve.now/CVE-2025-32900.md): In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information (CVSS 4.3, KDE Connect information-exchange protocol)
- [CVE-2025-32901](https://cve.now/CVE-2025-32901.md): In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash. (CVSS 4.3, KDEConnect)
- [CVE-2025-64052](https://cve.now/CVE-2025-64052.md): An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system comman (CVSS 5.1)
- [CVE-2025-64053](https://cve.now/CVE-2025-64053.md): A Buffer overflow vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrar (CVSS 7.5)
- [CVE-2025-64054](https://cve.now/CVE-2025-64054.md): A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potenti (CVSS 9.6)
- [CVE-2025-64056](https://cve.now/CVE-2025-64056.md): File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the fi (CVSS 4.3)
- [CVE-2025-64057](https://cve.now/CVE-2025-64057.md): Directory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store files in arbitrar (CVSS 8.3)
- [CVE-2025-65730](https://cve.now/CVE-2025-65730.md): Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used (CVSS 8.8)
- [CVE-2025-65878](https://cve.now/CVE-2025-65878.md): The warehouse management system version 1.2 contains an arbitrary file read vulnerability. (CVSS 7.5)
- [CVE-2025-65879](https://cve.now/CVE-2025-65879.md): Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability. (CVSS 8.1)
- [CVE-2025-65897](https://cve.now/CVE-2025-65897.md): zdh\_web is a data collection, processing, monitoring, scheduling, and management platform. (CVSS 8.8)
- [CVE-2025-66270](https://cve.now/CVE-2025-66270.md): The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets. (CVSS 4.7, KDE Connect protocol)
- [CVE-2025-66644](https://cve.now/CVE-2025-66644.md): Array Networks ArrayOS AG before 9.4.5.9 allows command injection, as exploited in the wild in August through December 2025. (CVSS 7.2, KEV, Array Networks ArrayOS AG)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.