# CVEs published 2025-12-14 44 CVEs were published on December 14, 2025: 1 critical, 7 high. Days are UTC. - [CVE-2025-67901](https://cve.now/CVE-2025-67901.md): openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a le (CVSS 5.3, kristapsdz openrsync) - [CVE-2025-14692](https://cve.now/CVE-2025-14692.md): Mayan EDMS authentication redirect (CVSS 5.3, Mayan EDMS · mayan-edms) - [CVE-2025-14691](https://cve.now/CVE-2025-14691.md): Mayan EDMS authentication cross site scripting (CVSS 5.3, Mayan EDMS · mayan-edms) - [CVE-2025-67900](https://cve.now/CVE-2025-67900.md): NXLog Agent before 6.11 can load a file specified by the OPENSSL\_CONF environment variable. (CVSS 8.1, NXLog Agent) - [CVE-2025-67899](https://cve.now/CVE-2025-67899.md): uriparser through 0.9.9 allows unbounded recursion and stack consumption, as demonstrated by ParseMustBeSegmentNzNc with large input contain (CVSS 2.9, uriparser project uriparser) - [CVE-2025-67898](https://cve.now/CVE-2025-67898.md): MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. (CVSS 4.5, MJML) - [CVE-2025-13281](https://cve.now/CVE-2025-13281.md): Portworx Half-Blind SSRF in kube-controller-manager (CVSS 5.8, Kubernetes · k8s.io/kubernetes) - [CVE-2025-14674](https://cve.now/CVE-2025-14674.md): aizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injection (CVSS 5.3, aizuda snail-job · com.aizuda:snail-job) - [CVE-2025-14673](https://cve.now/CVE-2025-14673.md): gmg137 snap7-rs client.rs as\_ct\_write heap-based overflow (CVSS 6.9, gmg137 snap7-rs) - [CVE-2025-14672](https://cve.now/CVE-2025-14672.md): gmg137 snap7-rs s7\_micro\_client.cpp opWriteArea heap-based overflow (CVSS 6.9, gmg137 snap7-rs) - [CVE-2025-14668](https://cve.now/CVE-2025-14668.md): campcodes Advanced Online Examination System loginExe.php sql injection (CVSS 6.9, campcodes Advanced Online Examination System) - [CVE-2025-14667](https://cve.now/CVE-2025-14667.md): itsourcecode COVID Tracking System page sql injection (CVSS 6.9, itsourcecode COVID Tracking System) - [CVE-2025-14666](https://cve.now/CVE-2025-14666.md): itsourcecode COVID Tracking System page sql injection (CVSS 6.9, itsourcecode COVID Tracking System) - [CVE-2025-14665](https://cve.now/CVE-2025-14665.md): Tenda WH450 HTTP Request DhcpListClient stack-based overflow (CVSS 9.3, Tenda WH450) - [CVE-2025-14664](https://cve.now/CVE-2025-14664.md): Campcodes Supplier Management System view\_unit.php sql injection (CVSS 6.9, Campcodes Supplier Management System) - [CVE-2025-14663](https://cve.now/CVE-2025-14663.md): code-projects Student File Management System update\_student.php cross site scripting (CVSS 4.8, code-projects Student File Management System) - [CVE-2025-14662](https://cve.now/CVE-2025-14662.md): code-projects Student File Management System Update User update\_user.php cross site scripting (CVSS 4.8, code-projects Student File Management System) - [CVE-2025-14661](https://cve.now/CVE-2025-14661.md): itsourcecode Student Managemen System advisers.php sql injection (CVSS 6.9, itsourcecode Student Managemen System) - [CVE-2025-14660](https://cve.now/CVE-2025-14660.md): DecoCMS Mesh Workspace Domain api.ts createTool access control (CVSS 6.3, DecoCMS Mesh) - [CVE-2025-14659](https://cve.now/CVE-2025-14659.md): D-Link DIR-860LB1/DIR-868LB1 DHCP command injection (CVSS 8.7, D-Link DIR-860LB1 · D-Link DIR-868LB1) - [CVE-2025-14656](https://cve.now/CVE-2025-14656.md): Tenda AC20 openSchedWifi httpd buffer overflow (CVSS 8.7, Tenda AC20) - [CVE-2025-14655](https://cve.now/CVE-2025-14655.md): Tenda AC20 httpd SetSysAutoRebbotCfg formSetRebootTimer stack-based overflow (CVSS 8.7, Tenda AC20) - [CVE-2025-14654](https://cve.now/CVE-2025-14654.md): Tenda AC20 httpd setPptpUserList formSetPPTPUserList stack-based overflow (CVSS 8.7, Tenda AC20) - [CVE-2025-14653](https://cve.now/CVE-2025-14653.md): itsourcecode Student Management System addrecord.php sql injection (CVSS 6.9, itsourcecode Student Management System) - [CVE-2025-14652](https://cve.now/CVE-2025-14652.md): itsourcecode Online Cake Ordering System admindetail.php sql injection (CVSS 6.9, itsourcecode Online Cake Ordering System) - [CVE-2025-14651](https://cve.now/CVE-2025-14651.md): MartialBE one-hub docker-compose.yml hard-coded key (CVSS 6.3, MartialBE one-hub) - [CVE-2025-14650](https://cve.now/CVE-2025-14650.md): itsourcecode Online Cake Ordering System product.php sql injection (CVSS 6.9, itsourcecode Online Cake Ordering System) - [CVE-2025-14649](https://cve.now/CVE-2025-14649.md): itsourcecode Online Cake Ordering System supplier.php sql injection (CVSS 6.9, itsourcecode Online Cake Ordering System) - [CVE-2025-14648](https://cve.now/CVE-2025-14648.md): DedeBIZ catalog\_add.php command injection (CVSS 5.1, DedeBIZ) - [CVE-2025-14647](https://cve.now/CVE-2025-14647.md): code-projects Computer Book Store admin\_delete.php sql injection (CVSS 6.9, code-projects Computer Book Store) - [CVE-2025-14646](https://cve.now/CVE-2025-14646.md): code-projects Student File Management System delete\_student.php sql injection (CVSS 6.9, code-projects Student File Management System) - [CVE-2025-12696](https://cve.now/CVE-2025-12696.md): HelloLeads CRM Form Shortcode \<= 1.0 - Unauthenticated Settings Reset (CVSS 5.3, HelloLeads CRM Form Shortcode) - [CVE-2025-14645](https://cve.now/CVE-2025-14645.md): code-projects Student File Management System delete\_user.php sql injection (CVSS 6.9, code-projects Student File Management System) - [CVE-2025-12537](https://cve.now/CVE-2025-12537.md): Addon Elements for Elementor \<= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpvibes Addon Elements for Elementor) - [CVE-2025-67897](https://cve.now/CVE-2025-67897.md): In Sequoia before 2.1.0, aes\_key\_unwrap panics if passed a ciphertext that is too short. (CVSS 5.3, sequoia-pgp sequoia · sequoia-openpgp) - [CVE-2025-13126](https://cve.now/CVE-2025-13126.md): wpForo Forum \<= 2.4.12 - Unauthenticated SQL Injection (CVSS 7.5, tomdever wpForo Forum) - [CVE-2025-67896](https://cve.now/CVE-2025-67896.md): Exim before 4.99.1, with certain non-default rate-limit configurations, allows a remote heap-based buffer overflow because database records (CVSS 7.0, Exim) - [CVE-2025-14644](https://cve.now/CVE-2025-14644.md): itsourcecode Student Management System update\_subject.php sql injection (CVSS 6.9, itsourcecode Student Management System) - [CVE-2025-14643](https://cve.now/CVE-2025-14643.md): code-projects Simple Attendance Record System check.php sql injection (CVSS 6.9, code-projects Simple Attendance Record System) - [CVE-2025-14642](https://cve.now/CVE-2025-14642.md): code-projects Computer Laboratory System technical\_staff\_pic.php unrestricted upload (CVSS 5.1, code-projects Computer Laboratory System) - [CVE-2025-14641](https://cve.now/CVE-2025-14641.md): code-projects Computer Laboratory System admin\_pic.php unrestricted upload (CVSS 5.1, code-projects Computer Laboratory System) - [CVE-2025-14640](https://cve.now/CVE-2025-14640.md): code-projects Student File Management System save\_student.php sql injection (CVSS 6.9, code-projects Student File Management System) - [CVE-2025-14639](https://cve.now/CVE-2025-14639.md): itsourcecode Student Management System uprec.php sql injection (CVSS 6.9, itsourcecode Student Management System) - [CVE-2025-14638](https://cve.now/CVE-2025-14638.md): itsourcecode Online Pet Shop Management System update\_cnp.php sql injection (CVSS 6.9, itsourcecode Online Pet Shop Management System) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-12-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.