# CVEs published 2025-12-15

149 CVEs were published on December 15, 2025: 16 critical, 58 high. Days are UTC.

- [CVE-2025-10900](https://cve.now/CVE-2025-10900.md): MODEL File Parsing Out-of-Bounds Write Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-10899](https://cve.now/CVE-2025-10899.md): MODEL File Parsing Out-of-Bounds Write Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-10898](https://cve.now/CVE-2025-10898.md): Multiple Vulnerabilities in Certain Autodesk Products (CVSS 7.8, Autodesk Shared Components · Autodesk AutoCAD)
- [CVE-2025-10889](https://cve.now/CVE-2025-10889.md): CATPART File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-10888](https://cve.now/CVE-2025-10888.md): MODEL File Parsing Out-of-Bounds Write Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-10887](https://cve.now/CVE-2025-10887.md): MODEL File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-10886](https://cve.now/CVE-2025-10886.md): MODEL File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-10884](https://cve.now/CVE-2025-10884.md): CATPART File Parsing Out-of-Bounds Write Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-10883](https://cve.now/CVE-2025-10883.md): CATPRODUCT File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-10882](https://cve.now/CVE-2025-10882.md): Multiple Vulnerabilities in Certain Autodesk Products (CVSS 7.8, Autodesk Shared Components · Autodesk AutoCAD)
- [CVE-2025-10881](https://cve.now/CVE-2025-10881.md): CATPRODUCT File Parsing Heap-Based Overflow Vulnerability (CVSS 7.8, Autodesk Shared Components · Autodesk AutoCAD)
- [CVE-2025-9460](https://cve.now/CVE-2025-9460.md): SLDPRT File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-9459](https://cve.now/CVE-2025-9459.md): SLDPRT File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-9457](https://cve.now/CVE-2025-9457.md): PRT File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-9456](https://cve.now/CVE-2025-9456.md): SLDPRT File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-66407](https://cve.now/CVE-2025-66407.md): Weblate has Server-Side Request Forgery vulnerability (CVSS 5.0, WeblateOrg weblate · weblate)
- [CVE-2025-9455](https://cve.now/CVE-2025-9455.md): CATPRODUCT File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-9454](https://cve.now/CVE-2025-9454.md): PRT File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-9453](https://cve.now/CVE-2025-9453.md): PRT File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-9452](https://cve.now/CVE-2025-9452.md): SLDPRT File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-14731](https://cve.now/CVE-2025-14731.md): CTCMS Content Management System Frontend/Template Management CT\_Parser.php special elements used in a template engine (CVSS 5.3, CTCMS Content Management System)
- [CVE-2025-14593](https://cve.now/CVE-2025-14593.md): CATPART File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk Shared Components)
- [CVE-2025-66482](https://cve.now/CVE-2025-66482.md): Misskey has a login rate limit bypass via spoofed X-Forwarded-For header (CVSS 6.9, misskey-dev misskey · misskey-js)
- [CVE-2025-66402](https://cve.now/CVE-2025-66402.md): misskey.js's export data contains private post data (CVSS 7.1, misskey-dev misskey · misskey-js)
- [CVE-2025-58173](https://cve.now/CVE-2025-58173.md): FreshRSS vulnerable to authenticated RCE via path traversal inside include() (CVSS 7.4, FreshRSS)
- [CVE-2025-14730](https://cve.now/CVE-2025-14730.md): CTCMS Content Management System Backend System Configuration Ct\_Config.php code injection (CVSS 5.1, CTCMS Content Management System)
- [CVE-2025-14729](https://cve.now/CVE-2025-14729.md): CTCMS Content Management System Backend App Configuration Ct\_App.php save code injection (CVSS 5.1, CTCMS Content Management System)
- [CVE-2025-64338](https://cve.now/CVE-2025-64338.md): ClipBucket's Manage Photos Feature is Vulnerable to Stored XSS via Collection Name (CVSS 5.1, MacWarrior clipbucket-v5)
- [CVE-2025-9121](https://cve.now/CVE-2025-9121.md): Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (CVSS 8.8, Hitachi Vantara Pentaho Data Integration and Analytics)
- [CVE-2025-9122](https://cve.now/CVE-2025-9122.md): Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (CVSS 5.3, Hitachi Vantara Pentaho Data Integration and Analytics)
- [CVE-2023-53879](https://cve.now/CVE-2023-53879.md): NVClient 5.0 Stack Buffer Overflow Vulnerability via User Configuration (CVSS 6.7, neonguvenlik NVClient)
- [CVE-2025-14722](https://cve.now/CVE-2025-14722.md): vion707 DMadmin Backend AddonsController.class.php add cross site scripting (CVSS 4.8, vion707 DMadmin)
- [CVE-2023-53893](https://cve.now/CVE-2023-53893.md): Ateme TITAN File 3.9 Authenticated Server-Side Request Forgery Vulnerability (CVSS 5.3, Ateme TITAN)
- [CVE-2023-53892](https://cve.now/CVE-2023-53892.md): Blackcat CMS 1.4 Remote Code Execution via Jquery Plugin Manager (CVSS 8.6, blackcat-cms Blackcat CMS)
- [CVE-2023-53891](https://cve.now/CVE-2023-53891.md): Blackcat CMS 1.4 Stored Cross-Site Scripting via Page Modification (CVSS 5.1, blackcat-cms Blackcat CMS)
- [CVE-2023-53890](https://cve.now/CVE-2023-53890.md): Perch CMS 3.2 Stored Cross-Site Scripting via SVG File Upload (CVSS 5.1, Perch)
- [CVE-2023-53889](https://cve.now/CVE-2023-53889.md): Perch CMS 3.2 Remote Code Execution via Unrestricted File Upload (CVSS 8.6, Perch)
- [CVE-2023-53888](https://cve.now/CVE-2023-53888.md): Zomplog 3.9 Remote Code Execution via Authenticated File Manipulation (CVSS 8.6, Zomplog)
- [CVE-2023-53887](https://cve.now/CVE-2023-53887.md): Zomplog 3.9 Cross-Site Scripting Vulnerability via Page Creation (CVSS 5.1, Zomplog)
- [CVE-2023-53886](https://cve.now/CVE-2023-53886.md): Xlight FTP Server 3.9.3.6 Stack Buffer Overflow Vulnerability via Execute Program (CVSS 5.1, Xlightftpd Xlight FTP Server)
- [CVE-2023-53885](https://cve.now/CVE-2023-53885.md): Webutler v3.2 Remote Code Execution via Arbitrary File Upload (CVSS 8.6, Webutler)
- [CVE-2023-53884](https://cve.now/CVE-2023-53884.md): Webedition CMS v2.9.8.8 Stored Cross-Site Scripting via SVG Upload (CVSS 5.1, Webedition CMS)
- [CVE-2023-53883](https://cve.now/CVE-2023-53883.md): Webedition CMS v2.9.8.8 Remote Code Execution via PHP Page Creation (CVSS 8.6, Webedition CMS)
- [CVE-2023-53882](https://cve.now/CVE-2023-53882.md): JLex GuestBook 1.6.4 Reflected Cross-Site Scripting via URL Parameter (CVSS 5.1, jlexart JLex GuestBook)
- [CVE-2023-53881](https://cve.now/CVE-2023-53881.md): ReyeeOS 1.204.1614 Man-in-the-Middle Remote Code Execution via CWMP (CVSS 9.2, Ruijie ReyeeOS)
- [CVE-2023-53880](https://cve.now/CVE-2023-53880.md): Lucee 5.4.2.17 Authenticated Reflected Cross-Site Scripting via Admin Interfaces (CVSS 4.8, Lucee)
- [CVE-2023-53878](https://cve.now/CVE-2023-53878.md): Member Login Script 3.3 Client-Side Request Desynchronization Vulnerability (CVSS 6.9, Phpjabbers Member Login Script)
- [CVE-2023-53877](https://cve.now/CVE-2023-53877.md): Bus Reservation System 1.1 Multiple SQL Injection via pickup\_id Parameter (CVSS 9.3, Phpjabbers Bus Reservation System)
- [CVE-2023-53876](https://cve.now/CVE-2023-53876.md): Academy LMS 6.1 Arbitrary File Upload Vulnerability via Profile Settings (CVSS 5.1, Creativeitem Academy LMS)
- [CVE-2023-53875](https://cve.now/CVE-2023-53875.md): GOM Player 2.3.90.5360 Remote Code Execution via Insecure IE Component (CVSS 7.5, Gomlab GOM Player)
- [CVE-2023-53874](https://cve.now/CVE-2023-53874.md): GOM Player 2.3.90.5360 Buffer Overflow via Equalizer Preset Name (CVSS 6.7, Gomlab GOM Player)
- [CVE-2023-53873](https://cve.now/CVE-2023-53873.md): SyncBreeze 15.2.24 Denial of Service via Login Endpoint Overflow (CVSS 8.7, SyncBreeze)
- [CVE-2023-53872](https://cve.now/CVE-2023-53872.md): Wp2Fac 1.0 OS Command Injection via send.php Endpoint (CVSS 9.3, Wp2Fac)
- [CVE-2023-53871](https://cve.now/CVE-2023-53871.md): Soosyze 2.0.0 Unrestricted File Upload via Broken Upload Logic (CVSS 6.9, Soosyze)
- [CVE-2023-53870](https://cve.now/CVE-2023-53870.md): Jorani 1.0.3 Cross-Site Scripting Vulnerability via Language Parameter (CVSS 5.1, Jorani)
- [CVE-2023-53869](https://cve.now/CVE-2023-53869.md): WEBIGniter 28.7.23 Unrestricted File Upload Remote Code Execution (CVSS 8.7, WebIGniter)
- [CVE-2023-53868](https://cve.now/CVE-2023-53868.md): Coppermine Gallery 1.6.25 Remote Code Execution via Plugin Upload (CVSS 8.7, coppermine-gallery)
- [CVE-2025-64725](https://cve.now/CVE-2025-64725.md): Weblate has improper validation upon invitation acceptance (CVSS 1.0, WeblateOrg weblate · weblate)
- [CVE-2025-59947](https://cve.now/CVE-2025-59947.md): NanoMQ has Buffer Overflow (CVSS 8.5, nanomq)
- [CVE-2025-13489](https://cve.now/CVE-2025-13489.md): IBM DevOps Deploy is susceptible to a Cleartext Transmission of Sensitive Information (CVSS 5.9, UCD - IBM DevOps Deploy)
- [CVE-2025-14503](https://cve.now/CVE-2025-14503.md): Overly Permissive Trust Policy in Harmonix on AWS EKS (CVSS 8.6, Harmonix on AWS)
- [CVE-2025-14148](https://cve.now/CVE-2025-14148.md): IBM DevOps Deploy is susceptible to a Insufficiently Protected Credentials vulnerability (CVSS 6.5, UCD - IBM DevOps Deploy)
- [CVE-2025-12035](https://cve.now/CVE-2025-12035.md): Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP (CVSS 6.5, zephyrproject-rtos Zephyr)
- [CVE-2025-36360](https://cve.now/CVE-2025-36360.md): IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Insufficient Session Expiration vulnerability (CVSS 5.0, UCD - IBM UrbanCode Deploy · UCD - IBM DevOps Deploy)
- [CVE-2025-14038](https://cve.now/CVE-2025-14038.md): EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. (CVSS 7.0, EnterpriseDB Hybrid Manager - LTS · EnterpriseDB Hybrid Man…)
- [CVE-2025-11393](https://cve.now/CVE-2025-11393.md): Insights-runtimes-tech-preview/runtimes-inventory-rhel8-operator: improper proxy configuration allows unauthorized administrative commands (CVSS 8.7, Red Hat Lightspeed (formerly Insights) for Runtimes · Re… +1)
- [CVE-2025-13888](https://cve.now/CVE-2025-13888.md): Openshift-gitops-operator: openshift gitops: namespace admin cluster takeover via privileged jobs (CVSS 9.1, redhat-developer gitops-operator · Red Hat OpenShift Git… +1)
- [CVE-2025-14387](https://cve.now/CVE-2025-14387.md): LearnPress – WordPress LMS Plugin \<= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get\_profile\_social (CVSS 6.4, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2025-13824](https://cve.now/CVE-2025-13824.md): Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities (CVSS 8.7, Rockwell Automation Micro820®, Micro850®, Micro870®)
- [CVE-2025-13823](https://cve.now/CVE-2025-13823.md): Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities (CVSS 7.1, Rockwell Automation Micro820®, Micro850®, Micro870®)
- [CVE-2025-34181](https://cve.now/CVE-2025-34181.md): NetSupport Manager \< 14.12.0001 Authenticated Path Traversal Arbitrary File Write RCE (CVSS 8.7, NetSupport Software Manager)
- [CVE-2025-34180](https://cve.now/CVE-2025-34180.md): NetSupport Manager \< 14.12.0001 Gateway Key Reversible Encoding Credential Recovery (CVSS 8.4, NetSupport Software Manager)
- [CVE-2025-34179](https://cve.now/CVE-2025-34179.md): NetSupport Manager \< 14.12.0001 Unauthenticated SQLi Local File Disclosure (CVSS 8.7, NetSupport Software Manager)
- [CVE-2025-14156](https://cve.now/CVE-2025-14156.md): Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder' (CVSS 9.8, ays-pro Fox LMS – WordPress LMS Plugin)
- [CVE-2025-13950](https://cve.now/CVE-2025-13950.md): OneSignal – Web Push Notifications \<= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update (CVSS 5.3, OneSignal – Web Push Notifications)
- [CVE-2025-13728](https://cve.now/CVE-2025-13728.md): FluentAuth - Auth Security Plugin \<= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent\_auth\_reset\_password' Shortcode (CVSS 6.4, techjewel FluentAuth – The Ultimate Authorization & Securit…)
- [CVE-2025-14383](https://cve.now/CVE-2025-14383.md): Booking Calendar \<= 10.14.8 - Unauthenticated SQL Injection via dates\_to\_check (CVSS 7.5, wpdevelop Booking Calendar)
- [CVE-2025-12900](https://cve.now/CVE-2025-12900.md): FileBird – WordPress Media Library Folders & File Manager \<= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering (CVSS 4.3, ninjateam FileBird – WordPress Media Library Folders & File…)
- [CVE-2025-13610](https://cve.now/CVE-2025-13610.md): RegistrationMagic \<= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM\_Forms' Shortcode (CVSS 6.4, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2025-14003](https://cve.now/CVE-2025-14003.md): Image Gallery – Photo Grid & Video Gallery \<= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification (CVSS 4.3, wpchill Modula Image Gallery – Photo Grid & Video Gallery)
- [CVE-2025-13367](https://cve.now/CVE-2025-13367.md): User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin \<= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4, wpeverest User Registration & Membership – Free & Paid Memb…)
- [CVE-2025-13608](https://cve.now/CVE-2025-13608.md): CC Child Pages \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'child\_pages' Shortcode (CVSS 6.4, caterhamcomputing CC Child Pages)
- [CVE-2025-66388](https://cve.now/CVE-2025-66388.md): Apache Airflow: Secrets in rendered templates not redacted properly and exposed in the UI (CVSS 4.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2025-11670](https://cve.now/CVE-2025-11670.md): NTLM Hash Exposure Vulnerability (CVSS 6.4, Zohocorp ManageEngine ADManager Plus)
- [CVE-2025-37731](https://cve.now/CVE-2025-37731.md): Elasticsearch Improper Authentication (CVSS 6.8, Elasticsearch · org.elasticsearch.plugin:x-pack-security +1)
- [CVE-2025-14714](https://cve.now/CVE-2025-14714.md): TCC Bypass via Inherited Permissions in Bundled Interpreter (CVSS 0.9, The Document Foundation LibreOffice)
- [CVE-2025-37732](https://cve.now/CVE-2025-37732.md): Kibana Cross-site Scripting via the Integration Package Upload Functionality (CVSS 5.4, Elastic Kibana)
- [CVE-2025-14711](https://cve.now/CVE-2025-14711.md): FantasticLBP Hotels Server hotelList.php sql injection (CVSS 6.9, FantasticLBP Hotels Server)
- [CVE-2025-14710](https://cve.now/CVE-2025-14710.md): FantasticLBP Hotels Server OrderList.php sql injection (CVSS 6.9, FantasticLBP Hotels Server)
- [CVE-2025-14709](https://cve.now/CVE-2025-14709.md): Shiguangwu sgwbox N3 WIRELESSCFGGET http\_eshell\_server buffer overflow (CVSS 9.3, Shiguangwu sgwbox N3)
- [CVE-2025-14023](https://cve.now/CVE-2025-14023.md): LINE client for iOS prior to 15.19 allows UI spoofing due to inconsistencies between the navigation state and the in-app browser's user inte (CVSS 3.1, LINE client for iOS)
- [CVE-2025-14022](https://cve.now/CVE-2025-14022.md): LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial (CVSS 7.7, LINE client for iOS)
- [CVE-2025-14021](https://cve.now/CVE-2025-14021.md): The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to exec (CVSS 4.3, LINE client for iOS)
- [CVE-2025-14020](https://cve.now/CVE-2025-14020.md): LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security To (CVSS 5.4, LINE client for Android)
- [CVE-2025-14019](https://cve.now/CVE-2025-14019.md): LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure (CVSS 3.4, LINE client for Android)
- [CVE-2025-14708](https://cve.now/CVE-2025-14708.md): Shiguangwu sgwbox N3 WIREDCFGGET http\_eshell\_server buffer overflow (CVSS 9.3, Shiguangwu sgwbox N3)
- [CVE-2025-14707](https://cve.now/CVE-2025-14707.md): Shiguangwu sgwbox N3 DOCKER Feature http\_eshell\_server command injection (CVSS 9.3, Shiguangwu sgwbox N3)
- [CVE-2025-13355](https://cve.now/CVE-2025-13355.md): URL Shortify \< 1.11.4 - Reflected XSS (CVSS 7.1, URL Shortify)
- [CVE-2025-12684](https://cve.now/CVE-2025-12684.md): URL Shortify \< 1.11.3 - Reflected XSS (CVSS 7.1, URL Shortify)
- [CVE-2025-11363](https://cve.now/CVE-2025-11363.md): Royal Elementor Addons and Templates \< 1.7.1037 - Unauthenticated Media File Upload (CVSS 5.3, Royal Addons for Elementor)
- [CVE-2025-14712](https://cve.now/CVE-2025-14712.md): JHENG GAO｜Student Learning Assessment and Support System - Exposure of Sensitive Information (CVSS 8.7, JHENG GAO Student Learning Assessment and Support System)
- [CVE-2025-14549](https://cve.now/CVE-2025-14549.md): OMR on Z processors Exposing a possible buffer over-read problem (CVSS 6.9, Eclipse OMR)
- [CVE-2025-14706](https://cve.now/CVE-2025-14706.md): Shiguangwu sgwbox N3 NETREBOOT http\_eshell\_server command injection (CVSS 9.3, Shiguangwu sgwbox N3)
- [CVE-2025-14705](https://cve.now/CVE-2025-14705.md): Shiguangwu sgwbox N3 SHARESERVER Feature command injection (CVSS 9.3, Shiguangwu sgwbox N3)
- [CVE-2025-14704](https://cve.now/CVE-2025-14704.md): Shiguangwu sgwbox N3 API eshell path traversal (CVSS 6.9, Shiguangwu sgwbox N3)
- [CVE-2025-14703](https://cve.now/CVE-2025-14703.md): Shiguangwu sgwbox N3 POST Message fsnotify improper authentication (CVSS 6.9, Shiguangwu sgwbox N3)
- [CVE-2025-14702](https://cve.now/CVE-2025-14702.md): Smartbit CommV Smartschool App be.smartschool.mobile.SplashActivity path traversal (CVSS 4.8, Smartbit CommV Smartschool App)
- [CVE-2025-67906](https://cve.now/CVE-2025-67906.md): In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. (CVSS 5.4, MISP)
- [CVE-2025-13740](https://cve.now/CVE-2025-13740.md): Lightweight Accordion \<= 1.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, someguy9 Lightweight Accordion)
- [CVE-2025-14699](https://cve.now/CVE-2025-14699.md): Municorn FAX App biz.faxapp.app path traversal (CVSS 4.8, Municorn FAX App)
- [CVE-2025-14698](https://cve.now/CVE-2025-14698.md): atlaszz AI Photo Team Galleryit App gallery.photogallery.pictures.vault.album path traversal (CVSS 4.8, atlaszz AI Photo Team Galleryit App)
- [CVE-2025-14697](https://cve.now/CVE-2025-14697.md): Shenzhen Sixun Software Sixun Shanghui Group Business Management System ExportFiles file access (CVSS 6.3, Shenzhen Sixun Software Sixun Shanghui Group Business Manag…)
- [CVE-2025-14696](https://cve.now/CVE-2025-14696.md): Shenzhen Sixun Software Sixun Shanghui Group Business Management System UpdatePasswordBatch password recovery (CVSS 6.9, Shenzhen Sixun Software Sixun Shanghui Group Business Manag…)
- [CVE-2025-14695](https://cve.now/CVE-2025-14695.md): SamuNatsu HaloBot Inter-plugin API index.js html\_renderer dynamically-managed code resources (CVSS 5.3, SamuNatsu HaloBot)
- [CVE-2025-14694](https://cve.now/CVE-2025-14694.md): ketr JEPaaS readAllPostil sql injection (CVSS 5.1, ketr JEPaaS)
- [CVE-2025-14693](https://cve.now/CVE-2025-14693.md): Ugreen DH2100+ USB symlink (CVSS 7.0, Ugreen DH2100+)
- [CVE-2023-36337](https://cve.now/CVE-2023-36337.md): A reflected cross-site scripting (XSS) vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers (CVSS 6.1)
- [CVE-2023-36338](https://cve.now/CVE-2023-36338.md): Inventory Management System 1 was discovered to contain a SQL injection vulnerability. (CVSS 5.3)
- [CVE-2023-38913](https://cve.now/CVE-2023-38913.md): SQL injection vulnerability in anirbandutta9 NEWS-BUZZ v.1.0 allows a remote attacker to execute arbitrary code via a crafted script. (CVSS 5.3)
- [CVE-2024-44598](https://cve.now/CVE-2024-44598.md): FNT Command 13.4.0 is vulnerable to Code Execution via the C Base Module. (CVSS 8.8)
- [CVE-2024-44599](https://cve.now/CVE-2024-44599.md): FNT Command 13.4.0 is vulnerable to Directory Traversal. (CVSS 8.3)
- [CVE-2025-51962](https://cve.now/CVE-2025-51962.md): A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrar (CVSS 6.1)
- [CVE-2025-55703](https://cve.now/CVE-2025-55703.md): An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. (CVSS 2.5)
- [CVE-2025-55893](https://cve.now/CVE-2025-55893.md): TOTOLINK N200RE V9.3.5u.6437\_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName. (CVSS 6.5)
- [CVE-2025-55895](https://cve.now/CVE-2025-55895.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 and N200RE V9.3.5u.6448\_B20240521 and V9.3.5u.6437\_B20230519 are vulnerable to Incorrect Access Cont (CVSS 9.1)
- [CVE-2025-55901](https://cve.now/CVE-2025-55901.md): TOTOLINK A3300R V17.0.0cu.596\_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host\_time parameter. (CVSS 6.5)
- [CVE-2025-60786](https://cve.now/CVE-2025-60786.md): A Zip Slip vulnerability in the import a Project component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via uplo (CVSS 8.8)
- [CVE-2025-65176](https://cve.now/CVE-2025-65176.md): An issue was discovered in Dynatrace OneAgent before 1.325.47. (CVSS 7.5)
- [CVE-2025-65213](https://cve.now/CVE-2025-65213.md): MooreThreads torch\_musa through all versions contains an unsafe deserialization vulnerability in torch\_musa.utils.compare\_tool. (CVSS 9.8)
- [CVE-2025-65430](https://cve.now/CVE-2025-65430.md): An issue was discovered in allauth-django before 65.13.0. (CVSS 5.4, django-allauth)
- [CVE-2025-65431](https://cve.now/CVE-2025-65431.md): An issue was discovered in allauth-django before 65.13.0. (CVSS 5.4, django-allauth)
- [CVE-2025-65742](https://cve.now/CVE-2025-65742.md): An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive in (CVSS 8.2)
- [CVE-2025-65778](https://cve.now/CVE-2025-65778.md): An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. (CVSS 8.1)
- [CVE-2025-65779](https://cve.now/CVE-2025-65779.md): An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. (CVSS 7.5)
- [CVE-2025-65780](https://cve.now/CVE-2025-65780.md): An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. (CVSS 8.8)
- [CVE-2025-65781](https://cve.now/CVE-2025-65781.md): An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. (CVSS 8.2)
- [CVE-2025-65782](https://cve.now/CVE-2025-65782.md): An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. (CVSS 6.5)
- [CVE-2025-65835](https://cve.now/CVE-2025-65835.md): The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receive (CVSS 6.2)
- [CVE-2025-66434](https://cve.now/CVE-2025-66434.md): An SSTI (Server-Side Template Injection) vulnerability exists in the get\_dunning\_letter\_text method of Frappe ERPNext through 15.89.0. (CVSS 8.8)
- [CVE-2025-66435](https://cve.now/CVE-2025-66435.md): An SSTI (Server-Side Template Injection) vulnerability exists in the get\_contract\_template method of Frappe ERPNext through 15.89.0. (CVSS 4.3)
- [CVE-2025-66436](https://cve.now/CVE-2025-66436.md): An SSTI (Server-Side Template Injection) vulnerability exists in the get\_terms\_and\_conditions method of Frappe ERPNext through 15.89.0. (CVSS 4.3)
- [CVE-2025-66437](https://cve.now/CVE-2025-66437.md): An SSTI (Server-Side Template Injection) vulnerability exists in the get\_address\_display method of Frappe ERPNext through 15.89.0. (CVSS 8.8)
- [CVE-2025-66438](https://cve.now/CVE-2025-66438.md): A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. (CVSS 9.8)
- [CVE-2025-66439](https://cve.now/CVE-2025-66439.md): An issue was discovered in Frappe ERPNext through 15.89.0. (CVSS 9.8)
- [CVE-2025-66440](https://cve.now/CVE-2025-66440.md): An issue was discovered in Frappe ERPNext through 15.89.0. (CVSS 9.8)
- [CVE-2025-66843](https://cve.now/CVE-2025-66843.md): grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. (CVSS 5.4, getgrav/grav)
- [CVE-2025-66844](https://cve.now/CVE-2025-66844.md): In grav \<1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig an (CVSS 9.1, getgrav/grav)
- [CVE-2025-66963](https://cve.now/CVE-2025-66963.md): An issue in Hitron HI3120 v.7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in the index.html (CVSS 5.5)
- [CVE-2025-67809](https://cve.now/CVE-2025-67809.md): An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. (CVSS 4.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.