CVEs published December 14, 2025
44 CVEs were published on December 14, 2025: 1 critical, 7 high.
- Published
- 44
- Critical
- 1
- High
- 7
- Medium
- 35
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- code-projects Student File Management System
- 5
- itsourcecode Online Cake Ordering System
- 3
- itsourcecode Student Management System
- 3
- Tenda AC20
- 3
- code-projects Computer Laboratory System
- 2
- gmg137 snap7-rs
- 2
- itsourcecode COVID Tracking System
- 2
- Mayan EDMS · mayan-edms
- 2
- aizuda snail-job · com.aizuda:snail-job
- 1
- campcodes Advanced Online Examination System
- 1
Critical 1
High 7
- CVE-2025-67900NXLog Agent before 6.11 can load a file specified by the OPENSSL_CONF environment variable.NXLog Agent
- CVE-2025-14659D-Link DIR-860LB1/DIR-868LB1 DHCP command injectionD-Link DIR-860LB1 · D-Link DIR-868LB1
- CVE-2025-14656Tenda AC20 openSchedWifi httpd buffer overflowTenda AC20
- CVE-2025-14655Tenda AC20 httpd SetSysAutoRebbotCfg formSetRebootTimer stack-based overflowTenda AC20
- CVE-2025-14654Tenda AC20 httpd setPptpUserList formSetPPTPUserList stack-based overflowTenda AC20
- CVE-2025-13126wpForo Forum <= 2.4.12 - Unauthenticated SQL Injectiontomdever wpForo Forum
- CVE-2025-67896Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records Exim
Medium, low and unrated 36
- CVE-2025-67901openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a lekristapsdz openrsync
- CVE-2025-14692Mayan EDMS authentication redirectMayan EDMS · mayan-edms
- CVE-2025-14691Mayan EDMS authentication cross site scriptingMayan EDMS · mayan-edms
- CVE-2025-67899uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input containuriparser project uriparser
- CVE-2025-67898MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files.MJML
- CVE-2025-13281Portworx Half-Blind SSRF in kube-controller-managerKubernetes · k8s.io/kubernetes
- CVE-2025-14674aizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injectionaizuda snail-job · com.aizuda:snail-job
- CVE-2025-14673gmg137 snap7-rs client.rs as_ct_write heap-based overflowgmg137 snap7-rs
- CVE-2025-14672gmg137 snap7-rs s7_micro_client.cpp opWriteArea heap-based overflowgmg137 snap7-rs
- CVE-2025-14668campcodes Advanced Online Examination System loginExe.php sql injectioncampcodes Advanced Online Examination System
- CVE-2025-14667itsourcecode COVID Tracking System page sql injectionitsourcecode COVID Tracking System
- CVE-2025-14666itsourcecode COVID Tracking System page sql injectionitsourcecode COVID Tracking System
- CVE-2025-14664Campcodes Supplier Management System view_unit.php sql injectionCampcodes Supplier Management System
- CVE-2025-14663code-projects Student File Management System update_student.php cross site scriptingcode-projects Student File Management System
- CVE-2025-14662code-projects Student File Management System Update User update_user.php cross site scriptingcode-projects Student File Management System
- CVE-2025-14661itsourcecode Student Managemen System advisers.php sql injectionitsourcecode Student Managemen System
- CVE-2025-14660DecoCMS Mesh Workspace Domain api.ts createTool access controlDecoCMS Mesh
- CVE-2025-14653itsourcecode Student Management System addrecord.php sql injectionitsourcecode Student Management System
- CVE-2025-14652itsourcecode Online Cake Ordering System admindetail.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2025-14651MartialBE one-hub docker-compose.yml hard-coded keyMartialBE one-hub
- CVE-2025-14650itsourcecode Online Cake Ordering System product.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2025-14649itsourcecode Online Cake Ordering System supplier.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2025-14648DedeBIZ catalog_add.php command injectionDedeBIZ
- CVE-2025-14647code-projects Computer Book Store admin_delete.php sql injectioncode-projects Computer Book Store
- CVE-2025-14646code-projects Student File Management System delete_student.php sql injectioncode-projects Student File Management System
- CVE-2025-12696HelloLeads CRM Form Shortcode <= 1.0 - Unauthenticated Settings ResetHelloLeads CRM Form Shortcode
- CVE-2025-14645code-projects Student File Management System delete_user.php sql injectioncode-projects Student File Management System
- CVE-2025-12537Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpvibes Addon Elements for Elementor
- CVE-2025-67897In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short.sequoia-pgp sequoia · sequoia-openpgp
- CVE-2025-14644itsourcecode Student Management System update_subject.php sql injectionitsourcecode Student Management System
- CVE-2025-14643code-projects Simple Attendance Record System check.php sql injectioncode-projects Simple Attendance Record System
- CVE-2025-14642code-projects Computer Laboratory System technical_staff_pic.php unrestricted uploadcode-projects Computer Laboratory System
- CVE-2025-14641code-projects Computer Laboratory System admin_pic.php unrestricted uploadcode-projects Computer Laboratory System
- CVE-2025-14640code-projects Student File Management System save_student.php sql injectioncode-projects Student File Management System
- CVE-2025-14639itsourcecode Student Management System uprec.php sql injectionitsourcecode Student Management System
- CVE-2025-14638itsourcecode Online Pet Shop Management System update_cnp.php sql injectionitsourcecode Online Pet Shop Management System