# CVEs published 2025-12-11

208 CVEs were published on December 11, 2025: 20 critical, 109 high. Days are UTC.

- [CVE-2025-67779](https://cve.now/CVE-2025-67779.md): It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attac (CVSS 7.5, Meta react-server-dom-parcel · Meta react-server-dom-tur… +4)
- [CVE-2025-67780](https://cve.now/CVE-2025-67780.md): SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1\_prod2) allow administrative actions via unauthenticated LAN gR (CVSS 4.2, SpaceX Starlink Dish)
- [CVE-2025-66452](https://cve.now/CVE-2025-66452.md): LibreChat's lack of JSON parsing error handling can lead to XSS (CVSS 5.3, danny-avila LibreChat)
- [CVE-2025-66451](https://cve.now/CVE-2025-66451.md): LibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission Changes (CVSS 5.3, danny-avila LibreChat)
- [CVE-2025-66450](https://cve.now/CVE-2025-66450.md): LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload (CVSS 8.6, danny-avila LibreChat)
- [CVE-2025-13668](https://cve.now/CVE-2025-13668.md): Quartus Prime Pro Edition Advisory (CVSS 5.4, Altera Quartus Prime Pro)
- [CVE-2025-66446](https://cve.now/CVE-2025-66446.md): MaxKB has a Python sandbox LD\_PRELOAD bypass (CVSS 8.8, 1Panel-dev MaxKB)
- [CVE-2025-34506](https://cve.now/CVE-2025-34506.md): WBCE CMS \<= 1.6.3 Authenticated Remote Code Execution via Module Upload (CVSS 8.6, WBCE CMS)
- [CVE-2025-34504](https://cve.now/CVE-2025-34504.md): KodExplorer 4.52 Open Redirect Vulnerability via User Login Endpoint (CVSS 5.3, kodcloud KodExplorer)
- [CVE-2025-34499](https://cve.now/CVE-2025-34499.md): AnyDesk 9.0.1 Unquoted Service Path Privilege Escalation Vulnerability (CVSS 6.9, AnyDesk)
- [CVE-2024-58313](https://cve.now/CVE-2024-58313.md): xbtitFM 4.1.18 Insecure File Upload in file\_hosting Feature (CVSS 8.6, xbtitFM)
- [CVE-2024-58312](https://cve.now/CVE-2024-58312.md): xbtitFM 4.1.18 Unauthenticated Path Traversal in nfogen.php (CVSS 8.7, xbtitFM)
- [CVE-2024-58310](https://cve.now/CVE-2024-58310.md): APC Network Management Card 4 Path Traversal via Directory Traversal (CVSS 8.7, Apc Network Management Card)
- [CVE-2024-58309](https://cve.now/CVE-2024-58309.md): xbtitFM 4.1.18 Unauthenticated SQL Injection in shoutedit.php (CVSS 8.7, xbtitFM)
- [CVE-2024-58308](https://cve.now/CVE-2024-58308.md): Quick.CMS 6.7 SQL Injection Authentication Bypass via Admin Login (CVSS 9.3, opensolution Quick.CMS)
- [CVE-2024-58307](https://cve.now/CVE-2024-58307.md): CSZCMS 1.3.0 Authenticated SQL Injection via Members View Endpoint (CVSS 9.3, CSZCMS)
- [CVE-2024-58306](https://cve.now/CVE-2024-58306.md): minaliC 2.0.0 Denial of Service Vulnerability via Large GET Request (CVSS 8.7, minaliC)
- [CVE-2024-58304](https://cve.now/CVE-2024-58304.md): SPA-CART CMS \< 2.0.0 Stored Cross-Site Scripting (CVSS 5.3, SPA-CART CMS)
- [CVE-2024-58303](https://cve.now/CVE-2024-58303.md): FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings (CVSS 8.6, FriendsofFlarum Pretty Mail · fof/pretty-mail)
- [CVE-2024-58302](https://cve.now/CVE-2024-58302.md): FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings (CVSS 6.9, FriendsofFlarum Pretty Mail)
- [CVE-2024-58301](https://cve.now/CVE-2024-58301.md): Purei CMS 1.0 SQL Injection via Multiple Vulnerable Endpoints (CVSS 9.3, Purei CMS)
- [CVE-2024-58300](https://cve.now/CVE-2024-58300.md): Siklu MultiHaul TG Series \<= 2.0.0 Unauthenticated Credential Disclosure Vulnerability (CVSS 8.7, Siklu MultiHaul TG series)
- [CVE-2025-66419](https://cve.now/CVE-2025-66419.md): MaxKB vulnerable to privilege escalation through sandbox bypass (CVSS 8.8, 1Panel-dev MaxKB)
- [CVE-2024-58298](https://cve.now/CVE-2024-58298.md): Compuware iStrobe Web 20.13 Pre-Auth Remote Code Execution via File Upload (CVSS 9.2, BMC Software Compuware iStrobe Web)
- [CVE-2024-58297](https://cve.now/CVE-2024-58297.md): PyroCMS v3.0.1 Stored Cross-Site Scripting via Admin Redirects (CVSS 5.3, PyroCMS)
- [CVE-2024-58296](https://cve.now/CVE-2024-58296.md): CE Phoenix v1.0.8.20 Stored Cross-Site Scripting via admin/currencies.php (CVSS 5.3, PhoenixCart CE Phoenix)
- [CVE-2024-58295](https://cve.now/CVE-2024-58295.md): ElkArte Forum 1.1.9 Authenticated Remote Code Execution via Theme Upload (CVSS 8.6, ElkArte Forum)
- [CVE-2024-58294](https://cve.now/CVE-2024-58294.md): FreePBX 16 Authenticated Remote Code Execution via API Module (CVSS 8.7, FreePBX)
- [CVE-2024-58293](https://cve.now/CVE-2024-58293.md): Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields (CVSS 8.6, Akaunting)
- [CVE-2024-58292](https://cve.now/CVE-2024-58292.md): XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates (CVSS 5.3, xmbforum2 XMB Forum)
- [CVE-2024-58291](https://cve.now/CVE-2024-58291.md): Flatboard 3.2 Authenticated Stored Cross-Site Scripting via Forum Information Field (CVSS 5.3, Flatboard)
- [CVE-2024-58290](https://cve.now/CVE-2024-58290.md): Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint (CVSS 9.3, Elements Xhibiter NFT Marketplace)
- [CVE-2024-58289](https://cve.now/CVE-2024-58289.md): Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields (CVSS 5.3, Microweber)
- [CVE-2024-58288](https://cve.now/CVE-2024-58288.md): Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation (CVSS 8.7, Genexus Protection Server)
- [CVE-2024-58287](https://cve.now/CVE-2024-58287.md): reNgine 2.2.0 Authenticated Command Injection via Scan Engine Configuration (CVSS 8.7, reNgine)
- [CVE-2024-58286](https://cve.now/CVE-2024-58286.md): dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path (CVSS 9.3, vexorian dizqueTV)
- [CVE-2025-64721](https://cve.now/CVE-2025-64721.md): Sandboxie's Integer Overflow in SbieIniServer::RC4Crypt allows sandbox escape and SYSTEM compromise (CVSS 9.9, sandboxie-plus Sandboxie)
- [CVE-2025-14538](https://cve.now/CVE-2025-14538.md): yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting (CVSS 5.1, yangshare warehouseManager 仓库管理系统)
- [CVE-2025-64702](https://cve.now/CVE-2025-64702.md): quic-go HTTP/3 QPACK Header Expansion DoS (CVSS 5.3, quic-go · github.com/quic-go/quic-go)
- [CVE-2025-66585](https://cve.now/CVE-2025-66585.md): Use After Free vulnerability in AzeoTech DAQFactory (CVSS 7.3, AzeoTech DAQFactory)
- [CVE-2025-13664](https://cve.now/CVE-2025-13664.md): Quartus Prime Standard Security Advisory (CVSS 6.7, Altera Quartus Prime Standard)
- [CVE-2025-66586](https://cve.now/CVE-2025-66586.md): Type Confusion vulnerability in AzeoTech DAQFactory (CVSS 7.3, AzeoTech DAQFactory)
- [CVE-2025-66588](https://cve.now/CVE-2025-66588.md): Access of Uninitialized Pointer vulnerability in AzeoTech DAQFactory (CVSS 8.4, AzeoTech DAQFactory)
- [CVE-2025-66589](https://cve.now/CVE-2025-66589.md): Out-of-bounds Read vulnerability in AzeoTech DAQFactory (CVSS 8.4, AzeoTech DAQFactory)
- [CVE-2025-66590](https://cve.now/CVE-2025-66590.md): Out-of-bounds Write vulnerability in AzeoTech DAQFactory (CVSS 8.4, AzeoTech DAQFactory)
- [CVE-2025-13663](https://cve.now/CVE-2025-13663.md): Quartus Prime Pro Edition Installer Advisory (CVSS 6.7, Altera Quartus Prime Pro)
- [CVE-2025-14537](https://cve.now/CVE-2025-14537.md): code-projects Class and Exam Timetable Management preview7.php sql injection (CVSS 6.9, code-projects Class and Exam Timetable Management)
- [CVE-2025-14293](https://cve.now/CVE-2025-14293.md): WP Job Portal \<= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read (CVSS 6.5, wpjobportal WP Job Portal – AI-Powered Recruitment System f…)
- [CVE-2025-55184](https://cve.now/CVE-2025-55184.md): A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2. (CVSS 7.5, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4)
- [CVE-2025-55183](https://cve.now/CVE-2025-55183.md): An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1. (CVSS 5.3, Meta react-server-dom-webpack · Meta react-server-dom-tu… +4)
- [CVE-2025-14536](https://cve.now/CVE-2025-14536.md): code-projects Class and Exam Timetable Management Login index.php sql injection (CVSS 6.9, code-projects Class and Exam Timetable Management)
- [CVE-2025-13214](https://cve.now/CVE-2025-13214.md): IBM Aspera Orchestrator SQL Injection (CVSS 7.6, IBM Aspera Orchestrator)
- [CVE-2025-13148](https://cve.now/CVE-2025-13148.md): IBM Aspera Orchestrator Unverified Password Change (CVSS 8.1, IBM Aspera Orchestrator)
- [CVE-2025-13481](https://cve.now/CVE-2025-13481.md): IBM Aspera Orchestrator Command Injection (CVSS 8.8, IBM Aspera Orchestrator)
- [CVE-2025-13211](https://cve.now/CVE-2025-13211.md): IBM Aspera Orchestrator Denial of Service (CVSS 5.3, IBM Aspera Orchestrator)
- [CVE-2024-42197](https://cve.now/CVE-2024-42197.md): HCL Workload Scheduler is vulnerable to plain text storage of a password (CVSS 5.5, HCL Software Workload Scheduler)
- [CVE-2025-36938](https://cve.now/CVE-2025-36938.md): In U-Boot of append\_uint32\_le(), there is a possible fault injection due to a logic error in the code. (CVSS 6.8, Google Android)
- [CVE-2025-36937](https://cve.now/CVE-2025-36937.md): In AudioDecoder::HandleProduceRequest of audio\_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 9.8, Google Android)
- [CVE-2025-36936](https://cve.now/CVE-2025-36936.md): In GetTachyonCommand of tachyon\_server\_common.h, there is a possible out of bounds write due to an integer overflow. (CVSS 7.8, Google Android)
- [CVE-2025-36935](https://cve.now/CVE-2025-36935.md): In trusty\_ffa\_mem\_reclaim of shared-mem-smcall.c, there is a possible memory corruption due to uninitialized data. (CVSS 7.8, Google Android)
- [CVE-2025-36934](https://cve.now/CVE-2025-36934.md): In bigo\_worker\_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. (CVSS 7.4, Google Android)
- [CVE-2025-36932](https://cve.now/CVE-2025-36932.md): In tracepoint\_msg\_handler of cpm/google/lib/tracepoint/tracepoint\_ipc.c, there is a possible memory overwrite due to improper input validati (CVSS 7.8, Google Android)
- [CVE-2025-36931](https://cve.now/CVE-2025-36931.md): In GetHostAddress of gxp\_buffer.h, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2025-36930](https://cve.now/CVE-2025-36930.md): In GetHostAddress of gxp\_buffer.h, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2025-36929](https://cve.now/CVE-2025-36929.md): In AreFencesRegistered of gxp\_fence\_manager.cc, there is a possible information leak due to improper input validation. (CVSS 5.5, Google Android)
- [CVE-2025-36928](https://cve.now/CVE-2025-36928.md): In GetHostAddress of gxp\_buffer.h, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2025-36927](https://cve.now/CVE-2025-36927.md): In GetTachyonCommand of tachyon\_server\_common.h, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2025-36925](https://cve.now/CVE-2025-36925.md): In WAVES\_send\_data\_to\_dsp of libaoc\_waves.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2025-36924](https://cve.now/CVE-2025-36924.md): In ss\_DecodeLcsAssistDataReqMsg(void) of ss\_LcsManagement.c, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 8.0, Google Android)
- [CVE-2025-36923](https://cve.now/CVE-2025-36923.md): In NrmmDecoder::DecodeSORTransparentContext of cn\_NrmmDecoder.cpp, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 8.0, Google Android)
- [CVE-2025-36922](https://cve.now/CVE-2025-36922.md): In bigo\_map of bigo\_iommu.c, there is a possible information disclosure due to a use after free. (CVSS 6.7, Google Android)
- [CVE-2025-36921](https://cve.now/CVE-2025-36921.md): In ProtocolPsUnthrottleApn() of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2025-36919](https://cve.now/CVE-2025-36919.md): In aocc\_read of aoc\_channel\_dev.c, there is a possible double free due to improper locking. (CVSS 7.8, Google Android)
- [CVE-2025-36918](https://cve.now/CVE-2025-36918.md): In aoc\_service\_read\_message of aoc\_ipc\_core.c, there is a possible out of bounds read due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2025-36917](https://cve.now/CVE-2025-36917.md): In SwDcpItg of up\_L2commonPdcpSecurity.cpp, there is a possible denial of service due to an incorrect bounds check. (CVSS 6.5, Google Android)
- [CVE-2025-36916](https://cve.now/CVE-2025-36916.md): In PrepareWorkloadBuffers of gxp\_main\_actor.cc, there is a possible double fetch due to a race condition. (CVSS 7.0, Google Android)
- [CVE-2025-36912](https://cve.now/CVE-2025-36912.md): In cellular modem, there is a possible denial of service due to a logic error in the code. (CVSS 6.5, Google Android)
- [CVE-2025-36889](https://cve.now/CVE-2025-36889.md): In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. (CVSS 5.5, Google Android)
- [CVE-2025-14535](https://cve.now/CVE-2025-14535.md): UTT 进取 512W formConfigFastDirectionW strcpy buffer overflow (CVSS 9.3, UTT 进取)
- [CVE-2025-14534](https://cve.now/CVE-2025-14534.md): UTT 进取 512W Endpoint formNatStaticMap strcpy buffer overflow (CVSS 9.3, UTT 进取)
- [CVE-2025-14531](https://cve.now/CVE-2025-14531.md): code-projects Rental Management System Log Transaction.java crlf injection (CVSS 5.3, code-projects Rental Management System)
- [CVE-2025-13780](https://cve.now/CVE-2025-13780.md): Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) (CVSS 9.1, pgadmin.org pgAdmin · pgadmin4)
- [CVE-2025-64669](https://cve.now/CVE-2025-64669.md): Windows Admin Center Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Admin Center)
- [CVE-2025-14046](https://cve.now/CVE-2025-14046.md): Insufficient HTML Sanitization Allows User-Controlled DOM Elements to Overwrite Server-Initialized Data Islands and Trigger Unintended Server-Side POST Requests (CVSS 8.6, GitHub Enterprise Server)
- [CVE-2025-14530](https://cve.now/CVE-2025-14530.md): SourceCodester Real Estate Property Listing App property.php unrestricted upload (CVSS 5.1, SourceCodester Real Estate Property Listing App)
- [CVE-2025-14529](https://cve.now/CVE-2025-14529.md): Campcodes Retro Basketball Shoes Online Store admin\_running.php sql injection (CVSS 6.9, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2025-13912](https://cve.now/CVE-2025-13912.md): Potential non-constant time compiled code with Clang LLVM (CVSS 1.0, wolfSSL)
- [CVE-2025-14528](https://cve.now/CVE-2025-14528.md): D-Link DIR-803 Configuration getcfg.php information disclosure (CVSS 6.9, D-Link DIR-803)
- [CVE-2025-14527](https://cve.now/CVE-2025-14527.md): projectworlds Advanced Library Management System view\_book.php sql injection (CVSS 6.9, projectworlds Advanced Library Management System)
- [CVE-2025-66048](https://cve.now/CVE-2025-66048.md): Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. (CVSS 9.8, The Biosig Project libbiosig)
- [CVE-2025-66047](https://cve.now/CVE-2025-66047.md): Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. (CVSS 9.8, The Biosig Project libbiosig)
- [CVE-2025-66046](https://cve.now/CVE-2025-66046.md): Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. (CVSS 9.8, The Biosig Project libbiosig)
- [CVE-2025-66045](https://cve.now/CVE-2025-66045.md): Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. (CVSS 9.8, The Biosig Project libbiosig)
- [CVE-2025-66044](https://cve.now/CVE-2025-66044.md): Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. (CVSS 9.8, The Biosig Project libbiosig)
- [CVE-2025-66043](https://cve.now/CVE-2025-66043.md): Several stack-based buffer overflow vulnerabilities exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.1. (CVSS 9.8, The Biosig Project libbiosig)
- [CVE-2025-14526](https://cve.now/CVE-2025-14526.md): Tenda CH22 L7Im frmL7ImForm buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2024-8273](https://cve.now/CVE-2024-8273.md): Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1. (CVSS 7.1, HYPR Server)
- [CVE-2025-14522](https://cve.now/CVE-2025-14522.md): baowzh hfly upload\_json.php unrestricted upload (CVSS 5.3, baowzh hfly)
- [CVE-2025-14521](https://cve.now/CVE-2025-14521.md): baowzh hfly download path traversal (CVSS 5.3, baowzh hfly)
- [CVE-2025-14520](https://cve.now/CVE-2025-14520.md): baowzh hfly delfile path traversal (CVSS 5.3, baowzh hfly)
- [CVE-2025-67742](https://cve.now/CVE-2025-67742.md): In JetBrains TeamCity before 2025.11 path traversal was possible via file upload (CVSS 3.8, JetBrains TeamCity)
- [CVE-2025-67741](https://cve.now/CVE-2025-67741.md): In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute (CVSS 4.8, JetBrains TeamCity)
- [CVE-2025-67740](https://cve.now/CVE-2025-67740.md): In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata (CVSS 2.7, JetBrains TeamCity)
- [CVE-2025-67739](https://cve.now/CVE-2025-67739.md): In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure (CVSS 3.1, JetBrains TeamCity)
- [CVE-2025-14519](https://cve.now/CVE-2025-14519.md): baowzh hfly advtext add cross site scripting (CVSS 5.1, baowzh hfly)
- [CVE-2025-14518](https://cve.now/CVE-2025-14518.md): PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgery (CVSS 5.3, PowerJob · tech.powerjob:powerjob-common)
- [CVE-2025-13124](https://cve.now/CVE-2025-13124.md): IDOR in Netiket''s ApplyLogic (CVSS 7.6, Netiket Information Technologies Ltd. ApplyLogic)
- [CVE-2025-14265](https://cve.now/CVE-2025-14265.md): Improper server-side validation in ScreenConnect extension framework (CVSS 9.1, ConnectWise ScreenConnect)
- [CVE-2024-40593](https://cve.now/CVE-2024-40593.md): A key management errors vulnerability in Fortinet FortiAnalyzer 7.4.0 through 7.4.2, FortiAnalyzer 7.2.0 through 7.2.5, FortiAnalyzer 7.0 al (CVSS 5.9, Fortinet FortiAnalyzer · Fortinet FortiPortal +2)
- [CVE-2025-14517](https://cve.now/CVE-2025-14517.md): Yalantis uCrop AndroidManifest.xml UCropActivity improper export of android application components (CVSS 4.8, Yalantis uCrop)
- [CVE-2025-14516](https://cve.now/CVE-2025-14516.md): Yalantis uCrop URL com.yalantis.ucrop.task.BitmapLoadTask.java downloadFile server-side request forgery (CVSS 5.3, Yalantis uCrop)
- [CVE-2025-14523](https://cve.now/CVE-2025-14523.md): Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins) (CVSS 8.2, Red Hat Enterprise Linux)
- [CVE-2025-13003](https://cve.now/CVE-2025-13003.md): IDOR in Aksis Computer's AxOnboard (CVSS 7.6, Aksis Computer Services and Consulting AxOnboard)
- [CVE-2025-14515](https://cve.now/CVE-2025-14515.md): Campcodes Supplier Management System add\_unit.php sql injection (CVSS 6.9, Campcodes Supplier Management System)
- [CVE-2025-14514](https://cve.now/CVE-2025-14514.md): Campcodes Supplier Management System add\_distributor.php sql injection (CVSS 6.9, Campcodes Supplier Management System)
- [CVE-2025-64995](https://cve.now/CVE-2025-64995.md): Privilege Escalation via Process Hijacking in 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction (CVSS 6.5, TeamViewer DEX)
- [CVE-2025-64994](https://cve.now/CVE-2025-64994.md): Privilege Escalation via Uncontrolled Search Path in 1E-Nomad-SetWorkRate instruction (CVSS 6.5, TeamViewer DEX)
- [CVE-2025-64993](https://cve.now/CVE-2025-64993.md): Command Injection in 1E-ConfigMgrConsoleExtensions Instructions (CVSS 6.8, TeamViewer DEX)
- [CVE-2025-64992](https://cve.now/CVE-2025-64992.md): Command Injection in 1E-Nomad-PauseNomadJobQueue Instruction (CVSS 6.8, TeamViewer DEX)
- [CVE-2025-64991](https://cve.now/CVE-2025-64991.md): Command Injection in 1E-PatchInsights-Deploy Instruction (CVSS 6.8, TeamViewer DEX)
- [CVE-2025-64990](https://cve.now/CVE-2025-64990.md): Command Injection in 1E-Explorer-TachyonCore-LogoffUser Instruction (CVSS 6.8, TeamViewer DEX)
- [CVE-2025-64989](https://cve.now/CVE-2025-64989.md): Command Injection in 1E-Explorer-TachyonCore-FindFileBySizeAndHash Instruction (CVSS 7.2, TeamViewer DEX)
- [CVE-2025-64988](https://cve.now/CVE-2025-64988.md): Command Injection in 1E-Nomad-GetCmContentLocations Instruction (CVSS 7.2, TeamViewer DEX)
- [CVE-2025-64987](https://cve.now/CVE-2025-64987.md): Command Injection in 1E-Explorer-TachyonCore-CheckSimpleIoC Instruction (CVSS 7.2, TeamViewer DEX)
- [CVE-2025-64986](https://cve.now/CVE-2025-64986.md): Command Injection in 1E-Explorer-TachyonCore-DevicesListeningOnAPort Instruction (CVSS 7.2, TeamViewer DEX)
- [CVE-2025-46266](https://cve.now/CVE-2025-46266.md): Unauthenticated Transmission of Data in NomadBranch.exe (CVSS 4.3, TeamViewer DEX)
- [CVE-2025-44016](https://cve.now/CVE-2025-44016.md): File Hash Validation Bypass in NomadBranch.exe (CVSS 8.8, TeamViewer DEX)
- [CVE-2025-12687](https://cve.now/CVE-2025-12687.md): Denial-of-Service Vulnerability in NomadBranch.exe (CVSS 6.5, TeamViewer DEX)
- [CVE-2025-64701](https://cve.now/CVE-2025-64701.md): QND Premium/Advance/Standard Ver.11.0.9i and prior contains a privilege escalation vulnerability, which may allow a user who can log in to a (CVSS 7.8, QualitySoft QND Premium/Advance/Standard)
- [CVE-2025-12029](https://cve.now/CVE-2025-12029.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.0, GitLab)
- [CVE-2025-12734](https://cve.now/CVE-2025-12734.md): Improper Encoding or Escaping of Output in GitLab (CVSS 3.5, GitLab)
- [CVE-2025-14512](https://cve.now/CVE-2025-14512.md): Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow (CVSS 6.5, GNOME glib · Red Hat Enterprise Linux +8)
- [CVE-2025-67738](https://cve.now/CVE-2025-67738.md): squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. (CVSS 8.5, Webmin)
- [CVE-2025-4097](https://cve.now/CVE-2025-4097.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-8405](https://cve.now/CVE-2025-8405.md): Improper Encoding or Escaping of Output in GitLab (CVSS 7.7, GitLab)
- [CVE-2025-11247](https://cve.now/CVE-2025-11247.md): Authorization Bypass Through User-Controlled Key in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-11984](https://cve.now/CVE-2025-11984.md): Authentication Bypass Using an Alternate Path or Channel in GitLab (CVSS 6.8, GitLab)
- [CVE-2025-12562](https://cve.now/CVE-2025-12562.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-12716](https://cve.now/CVE-2025-12716.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2025-13978](https://cve.now/CVE-2025-13978.md): Generation of Error Message Containing Sensitive Information in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-14157](https://cve.now/CVE-2025-14157.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-9436](https://cve.now/CVE-2025-9436.md): Widgets for Google Reviews \<= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode (CVSS 6.4, trustindex Widgets for Google Reviews)
- [CVE-2025-10163](https://cve.now/CVE-2025-10163.md): List Category Posts \<= 0.91.0 - Authenticated (Contributor+) SQL Injection via Plugin's Shortcode (CVSS 6.5, fernandobt List category posts)
- [CVE-2025-14485](https://cve.now/CVE-2025-14485.md): EFM ipTIME A3004T Administrator Password timepro.cgi show\_debug\_screen command injection (CVSS 2.3, EFM ipTIME A3004T)
- [CVE-2025-13764](https://cve.now/CVE-2025-13764.md): WP CarDealer \<= 1.2.16 - Unauthenticated Privilege Escalation (CVSS 9.8, ApusTheme WP CarDealer)
- [CVE-2025-11467](https://cve.now/CVE-2025-11467.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery (CVSS 5.8, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2025-67720](https://cve.now/CVE-2025-67720.md): Pyrofork has a Path Traversal in download\_media Method (CVSS 6.5, Mayuri-Chan pyrofork · pyrofork)
- [CVE-2025-67719](https://cve.now/CVE-2025-67719.md): Ibexa User Bundle is missing password change validation (CVSS 8.5, ibexa user · ibexa/user)
- [CVE-2025-67718](https://cve.now/CVE-2025-67718.md): Formio improperly authorized permission elevation through specially crafted request path (CVSS 8.7, formio)
- [CVE-2025-67717](https://cve.now/CVE-2025-67717.md): Zitadel Discloses the Total Number of Instance Users (CVSS 5.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2025-67716](https://cve.now/CVE-2025-67716.md): Auth0 Next.js SDK has Improper Validation of Query Parameters (CVSS 5.7, nextjs-auth0 · @auth0/nextjs-auth0)
- [CVE-2025-67713](https://cve.now/CVE-2025-67713.md): Miniflux 2 has an Open Redirect via protocol-relative \`redirect\_url\` (CVSS 5.3, miniflux · miniflux.app/v2 +1)
- [CVE-2025-55307](https://cve.now/CVE-2025-55307.md): An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. (CVSS 3.3)
- [CVE-2025-55308](https://cve.now/CVE-2025-55308.md): An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. (CVSS 6.7)
- [CVE-2025-55309](https://cve.now/CVE-2025-55309.md): An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. (CVSS 6.7)
- [CVE-2025-55310](https://cve.now/CVE-2025-55310.md): An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. (CVSS 7.3)
- [CVE-2025-55311](https://cve.now/CVE-2025-55311.md): An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. (CVSS 6.5)
- [CVE-2025-55312](https://cve.now/CVE-2025-55312.md): An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. (CVSS 7.8)
- [CVE-2025-55313](https://cve.now/CVE-2025-55313.md): An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. (CVSS 7.8)
- [CVE-2025-55314](https://cve.now/CVE-2025-55314.md): An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. (CVSS 7.8)
- [CVE-2025-55816](https://cve.now/CVE-2025-55816.md): HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica\_app.php file. (CVSS 6.1)
- [CVE-2025-56077](https://cve.now/CVE-2025-56077.md): OS Command Injection vulnerability in Ruijie RG-RAP2200(E) 247 2200 allowing attackers to execute arbitrary commands via a crafted POST requ (CVSS 8.8)
- [CVE-2025-56079](https://cve.now/CVE-2025-56079.md): OS Command Injection vulnerability in Ruijie RG-EW1300G EW1300G V1.00/V2.00/V4.00 allowing attackers to execute arbitrary commands via a cra (CVSS 8.8)
- [CVE-2025-56082](https://cve.now/CVE-2025-56082.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t (CVSS 8.8)
- [CVE-2025-56083](https://cve.now/CVE-2025-56083.md): OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1\_09241521 allowing attackers to execute arbitrary commands via a crafted POST (CVSS 8.8)
- [CVE-2025-56084](https://cve.now/CVE-2025-56084.md): OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226\_EW1800GX-PRO\_10223117 allowing attackers to execute arbitrary commands (CVSS 8.8)
- [CVE-2025-56085](https://cve.now/CVE-2025-56085.md): OS Command Injection vulnerability in Ruijie RG-EW1200 EW\_3.0(1)B11P227\_EW1200\_11130208RG-EW1200 V1.00 allowing attackers to execute arbitra (CVSS 8.8)
- [CVE-2025-56086](https://cve.now/CVE-2025-56086.md): OS Command Injection vulnerability in Ruijie RG-EW1200 EW\_3.0(1)B11P227\_EW1200\_11130208RG-EW1200 V1.00 allowing attackers to execute arbitra (CVSS 8.8)
- [CVE-2025-56087](https://cve.now/CVE-2025-56087.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t (CVSS 8.8)
- [CVE-2025-56088](https://cve.now/CVE-2025-56088.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to (CVSS 8.8)
- [CVE-2025-56089](https://cve.now/CVE-2025-56089.md): OS Command Injection vulnerability in Ruijie M18 EW\_3.0(1)B11P226\_M18\_10223116 allowing attackers to execute arbitrary commands via a crafte (CVSS 8.8)
- [CVE-2025-56090](https://cve.now/CVE-2025-56090.md): OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary c (CVSS 8.8)
- [CVE-2025-56091](https://cve.now/CVE-2025-56091.md): OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226\_EW1800GX\_10223121 allowing attackers to execute arbitrary commands via a cr (CVSS 8.8)
- [CVE-2025-56092](https://cve.now/CVE-2025-56092.md): OS Command Injection vulnerability in Ruijie X30 PRO V1 X30-PRO-V1\_09241521 allowing attackers to execute arbitrary commands via a crafted P (CVSS 8.8)
- [CVE-2025-56093](https://cve.now/CVE-2025-56093.md): OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1\_09241521 allowing attackers to execute arbitrary commands via a crafted POST (CVSS 8.8)
- [CVE-2025-56094](https://cve.now/CVE-2025-56094.md): OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1\_09241521 allowing attackers to execute arbitrary commands via a crafted POST (CVSS 8.8)
- [CVE-2025-56095](https://cve.now/CVE-2025-56095.md): OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary c (CVSS 8.8)
- [CVE-2025-56096](https://cve.now/CVE-2025-56096.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t (CVSS 8.8)
- [CVE-2025-56097](https://cve.now/CVE-2025-56097.md): OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226\_EW1800GX-PRO\_10223117 allowing attackers to execute arbitrary commands (CVSS 8.8)
- [CVE-2025-56098](https://cve.now/CVE-2025-56098.md): OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1\_09241521 allowing attackers to execute arbitrary commands via a crafted POST (CVSS 8.8)
- [CVE-2025-56099](https://cve.now/CVE-2025-56099.md): OS Command Injection vulnerability in Ruijie RG-YST AP\_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted P (CVSS 8.8)
- [CVE-2025-56101](https://cve.now/CVE-2025-56101.md): OS Command Injection vulnerability in Ruijie M18 EW\_3.0(1)B11P226\_M18\_10223116 allowing attackers to execute arbitrary commands via a crafte (CVSS 8.8)
- [CVE-2025-56102](https://cve.now/CVE-2025-56102.md): OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226\_EW1800GX\_10223121 allowing attackers to execute arbitrary commands via a cr (CVSS 8.8)
- [CVE-2025-56106](https://cve.now/CVE-2025-56106.md): OS Command Injection vulnerability in Ruijie RG-EW1800GX B11P226\_EW1800GX\_10223121 allowing attackers to execute arbitrary commands via a cr (CVSS 8.8)
- [CVE-2025-56107](https://cve.now/CVE-2025-56107.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t (CVSS 8.8)
- [CVE-2025-56108](https://cve.now/CVE-2025-56108.md): OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1\_09241521 allowing attackers to execute arbitrary commands via a crafted POST (CVSS 8.8)
- [CVE-2025-56109](https://cve.now/CVE-2025-56109.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to (CVSS 8.8)
- [CVE-2025-56110](https://cve.now/CVE-2025-56110.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to (CVSS 8.8)
- [CVE-2025-56111](https://cve.now/CVE-2025-56111.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to (CVSS 8.8)
- [CVE-2025-56113](https://cve.now/CVE-2025-56113.md): OS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP\_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary comma (CVSS 8.8)
- [CVE-2025-56114](https://cve.now/CVE-2025-56114.md): OS Command Injection vulnerability in Ruijie M18 EW\_3.0(1)B11P226\_M18\_10223116 allowing attackers to execute arbitrary commands via a crafte (CVSS 8.8)
- [CVE-2025-56117](https://cve.now/CVE-2025-56117.md): OS Command Injection vulnerability in Ruijie X30-PRO X30-PRO-V1\_09241521 allowing attackers to execute arbitrary commands via a crafted POST (CVSS 8.8)
- [CVE-2025-56118](https://cve.now/CVE-2025-56118.md): OS Command Injection vulnerability in Ruijie X60 PRO X60\_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via (CVSS 8.8)
- [CVE-2025-56120](https://cve.now/CVE-2025-56120.md): OS Command Injection vulnerability in Ruijie X60 PRO X60\_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via (CVSS 8.8)
- [CVE-2025-56122](https://cve.now/CVE-2025-56122.md): OS Command Injection vulnerability in Ruijie RG-EW1800GX PRO B11P226\_EW1800GX-PRO\_10223117 allowing attackers to execute arbitrary commands (CVSS 8.8)
- [CVE-2025-56123](https://cve.now/CVE-2025-56123.md): OS Command Injection vulnerability in Ruijie RG-EW1200G PRO RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 allowing attackers to execute arbitrary c (CVSS 8.8)
- [CVE-2025-56124](https://cve.now/CVE-2025-56124.md): OS Command Injection vulnerability in Ruijie X60 PRO X60\_10212014RG-X60 PRO V1.00/V2.00 allowing attackers to execute arbitrary commands via (CVSS 7.8)
- [CVE-2025-56127](https://cve.now/CVE-2025-56127.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR600W allowing attackers to execute arbitrary commands via a crafted POST request t (CVSS 8.8)
- [CVE-2025-56129](https://cve.now/CVE-2025-56129.md): OS Command Injection vulnerability in Ruijie RG-BCR RG-BCR860 allowing attackers to execute arbitrary commands via a crafted POST request to (CVSS 8.8)
- [CVE-2025-56130](https://cve.now/CVE-2025-56130.md): OS Command Injection vulnerability in Ruijie RG-S1930 S1930SWITCH\_3.0(1)B11P230 allowing attackers to execute arbitrary commands via a craft (CVSS 8.8)
- [CVE-2025-59802](https://cve.now/CVE-2025-59802.md): Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. (CVSS 7.5)
- [CVE-2025-59803](https://cve.now/CVE-2025-59803.md): Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. (CVSS 5.3)
- [CVE-2025-65471](https://cve.now/CVE-2025-65471.md): An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute ar (CVSS 8.8)
- [CVE-2025-65472](https://cve.now/CVE-2025-65472.md): A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate pr (CVSS 8.8)
- [CVE-2025-65473](https://cve.now/CVE-2025-65473.md): An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administra (CVSS 9.1)
- [CVE-2025-65474](https://cve.now/CVE-2025-65474.md): An arbitrary file rename vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute ar (CVSS 8.8)
- [CVE-2025-66429](https://cve.now/CVE-2025-66429.md): An issue was discovered in cPanel 110 through 132. (CVSS 8.8)
- [CVE-2025-66918](https://cve.now/CVE-2025-66918.md): edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.