# CVEs published 2025-12-07

23 CVEs were published on December 7, 2025: 0 critical, 4 high. Days are UTC.

- [CVE-2025-14205](https://cve.now/CVE-2025-14205.md): code-projects Chamber of Commerce Membership Management System Your Info membership\_profile.php cross site scripting (CVSS 4.8, code-projects Chamber of Commerce Membership Management Sys…)
- [CVE-2025-14204](https://cve.now/CVE-2025-14204.md): TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command injection (CVSS 5.3, TykoDev cherry-studio-TykoFork)
- [CVE-2025-14203](https://cve.now/CVE-2025-14203.md): code-projects Question Paper Generator selectquestionuser.php sql injection (CVSS 5.3, code-projects Question Paper Generator)
- [CVE-2025-14201](https://cve.now/CVE-2025-14201.md): alokjaiswal Hotel-Management-services-using-MYSQL-and-php dishsub.php cross site scripting (CVSS 4.8, alokjaiswal Hotel-Management-services-using-MYSQL-and-php)
- [CVE-2025-14200](https://cve.now/CVE-2025-14200.md): alokjaiswal Hotel-Management-services-using-MYSQL-and-php Request Pending usersub.php cross site scripting (CVSS 5.1, alokjaiswal Hotel-Management-services-using-MYSQL-and-php)
- [CVE-2025-14199](https://cve.now/CVE-2025-14199.md): Verysync 微力同步 Web Administration text.txt unrestricted upload (CVSS 5.3, Verysync 微力同步)
- [CVE-2025-14198](https://cve.now/CVE-2025-14198.md): Verysync 微力同步 Web Administration download information disclosure (CVSS 6.9, Verysync 微力同步)
- [CVE-2025-14197](https://cve.now/CVE-2025-14197.md): Verysync 微力同步 Web Administration f96956469e7be39d information disclosure (CVSS 6.9, Verysync 微力同步)
- [CVE-2025-14196](https://cve.now/CVE-2025-14196.md): H3C Magic B1 aspForm sub\_44de0 buffer overflow (CVSS 8.7, H3C Magic B1)
- [CVE-2025-14195](https://cve.now/CVE-2025-14195.md): code-projects Employee Profile Management System add\_file\_query.php unrestricted upload (CVSS 5.3, code-projects Employee Profile Management System)
- [CVE-2025-14194](https://cve.now/CVE-2025-14194.md): code-projects Employee Profile Management System view\_personnel.php cross site scripting (CVSS 5.1, code-projects Employee Profile Management System)
- [CVE-2025-14193](https://cve.now/CVE-2025-14193.md): code-projects Employee Profile Management System view\_personnel.php sql injection (CVSS 5.3, code-projects Employee Profile Management System)
- [CVE-2025-14192](https://cve.now/CVE-2025-14192.md): RashminDungrani online-banking auth\_login.php sql injection (CVSS 6.9, RashminDungrani online-banking)
- [CVE-2025-14191](https://cve.now/CVE-2025-14191.md): UTT 进取 512W formP2PLimitConfig strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-14190](https://cve.now/CVE-2025-14190.md): Chanjet TPlus sql injection (CVSS 6.9, Chanjet TPlus)
- [CVE-2025-14189](https://cve.now/CVE-2025-14189.md): Chanjet CRM jxf\_dump\_table\_demo.php sql injection (CVSS 6.9, Chanjet CRM)
- [CVE-2025-14188](https://cve.now/CVE-2025-14188.md): UGREEN DH2100+ nas\_svr create handler\_file\_backup\_create command injection (CVSS 8.6, UGREEN DH2100+)
- [CVE-2025-14187](https://cve.now/CVE-2025-14187.md): UGREEN DH2100+ nas\_svr create handler\_file\_backup\_create buffer overflow (CVSS 8.6, UGREEN DH2100+)
- [CVE-2025-14186](https://cve.now/CVE-2025-14186.md): Grandstream GXP1625 Network Status api.values.post cross site scripting (CVSS 5.1, Grandstream GXP1625)
- [CVE-2025-14185](https://cve.now/CVE-2025-14185.md): Yonyou U8 Cloud AppServletService.class sql injection (CVSS 5.3, Yonyou U8 Cloud)
- [CVE-2025-14184](https://cve.now/CVE-2025-14184.md): SGAI Space1 NAS N1211DS gsaiagent JSONAPI NGNIX\_UPLOAD command injection (CVSS 5.3, SGAI Space1 NAS N1211DS)
- [CVE-2025-14183](https://cve.now/CVE-2025-14183.md): SGAI Space1 NAS N1211DS gsaiagent JSONAPI GET\_USER\_INFO credentials storage (CVSS 5.3, SGAI Space1 NAS N1211DS)
- [CVE-2025-14182](https://cve.now/CVE-2025-14182.md): Sobey Media Convergence System upload path traversal (CVSS 5.3, Sobey Media Convergence System)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.