CVEs published December 25, 2025
32 CVEs were published on December 25, 2025: 1 critical, 13 high.
- Published
- 32
- Critical
- 1
- High
- 13
- Medium
- 16
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Pexip Infinity
- 9
- youlaitech youlai-mall
- 4
- itsourcecode Student Management System
- 3
- UTT 进取
- 3
- Verisay Communication and Information Technology Industry a…
- 3
- ONLYOFFICE Document Server
- 2
- TOZED ZLT M30s
- 2
- Forgejo
- 1
- itsourcecode Online Frozen Foods Ordering System
- 1
- JD Cloud BE6500
- 1
Critical 1
High 13
- CVE-2025-15091UTT 进取 512W formPictureUrl strcpy buffer overflowUTT 进取
- CVE-2025-15090UTT 进取 512W formConfigNoticeConfig strcpy buffer overflowUTT 进取
- CVE-2025-15089UTT 进取 512W APSecurity strcpy buffer overflowUTT 进取
- CVE-2025-2307XSS in Verisay Communication's AidangoVerisay Communication and Information Technology Industry a…
- CVE-2025-2406XSS in Verisay Communication's TrizbiVerisay Communication and Information Technology Industry a…
- CVE-2025-2405XSS in Verisay Communication's TitarusVerisay Communication and Information Technology Industry a…
- CVE-2025-32095Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a craftPexip Infinity
- CVE-2025-32096Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort,Pexip Infinity
- CVE-2025-48704Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abortPexip Infinity
- CVE-2025-59683Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with OfficePexip Infinity
- CVE-2025-66377Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already hPexip Infinity
- CVE-2025-66379Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abortPexip Infinity
- CVE-2025-66443Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation Pexip Infinity
Medium, low and unrated 18
- CVE-2025-14913Frontend Post Submission Manager Lite <= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletionwpshuffle Frontend Post Submission Manager Lite – Frontend…
- CVE-2025-15088ketr JEPaaS loadPostil postilService.loadPostils sql injectionketr JEPaaS
- CVE-2025-15087youlaitech youlai-mall OrderController.java submitOrderPayment improper authorizationyoulaitech youlai-mall
- CVE-2025-15086youlaitech youlai-mall MemberController.java getMemberByMobile access controlyoulaitech youlai-mall
- CVE-2025-68936ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name.ONLYOFFICE Document Server
- CVE-2025-68935ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window.ONLYOFFICE Document Server
- CVE-2025-15085youlaitech youlai-mall Balance MemberController.java deductBalance improper authorizationyoulaitech youlai-mall
- CVE-2025-15084youlaitech youlai-mall Order Payment OrderController.java orderService.payOrder access controlyoulaitech youlai-mall
- CVE-2025-15083TOZED ZLT M30s UART on-chip debug and test interface with improper access controlTOZED ZLT M30s
- CVE-2025-15082TOZED ZLT M30s Web Management proc_post information disclosureTOZED ZLT M30s
- CVE-2025-15081JD Cloud BE6500 jdcapi sub_4780 command injectionJD Cloud BE6500
- CVE-2025-15078itsourcecode Student Management System list_report.php sql injectionitsourcecode Student Management System
- CVE-2025-15077itsourcecode Student Management System form137.php sql injectionitsourcecode Student Management System
- CVE-2025-15076Tenda CH22 public path traversalTenda CH22
- CVE-2025-15075itsourcecode Student Management System student_p.php sql injectionitsourcecode Student Management System
- CVE-2025-15074itsourcecode Online Frozen Foods Ordering System customer_details.php sql injectionitsourcecode Online Frozen Foods Ordering System
- CVE-2025-49088Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper InputPexip Infinity
- CVE-2025-66378Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMPPexip Infinity