# CVEs published 2025-12-25

32 CVEs were published on December 25, 2025: 1 critical, 13 high. Days are UTC.

- [CVE-2025-68937](https://cve.now/CVE-2025-68937.md): Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out- (CVSS 9.5, Forgejo)
- [CVE-2025-15091](https://cve.now/CVE-2025-15091.md): UTT 进取 512W formPictureUrl strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-14913](https://cve.now/CVE-2025-14913.md): Frontend Post Submission Manager Lite \<= 1.2.6 - Incorrect Authorization to Unauthenticated Arbitrary Attachment Deletion (CVSS 5.3, wpshuffle Frontend Post Submission Manager Lite – Frontend…)
- [CVE-2025-15090](https://cve.now/CVE-2025-15090.md): UTT 进取 512W formConfigNoticeConfig strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-15089](https://cve.now/CVE-2025-15089.md): UTT 进取 512W APSecurity strcpy buffer overflow (CVSS 8.7, UTT 进取)
- [CVE-2025-15088](https://cve.now/CVE-2025-15088.md): ketr JEPaaS loadPostil postilService.loadPostils sql injection (CVSS 5.3, ketr JEPaaS)
- [CVE-2025-15087](https://cve.now/CVE-2025-15087.md): youlaitech youlai-mall OrderController.java submitOrderPayment improper authorization (CVSS 5.3, youlaitech youlai-mall)
- [CVE-2025-15086](https://cve.now/CVE-2025-15086.md): youlaitech youlai-mall MemberController.java getMemberByMobile access control (CVSS 5.3, youlaitech youlai-mall)
- [CVE-2025-68936](https://cve.now/CVE-2025-68936.md): ONLYOFFICE Docs before 9.2.1 allows XSS via the Color theme name. (CVSS 6.4, ONLYOFFICE Document Server)
- [CVE-2025-68935](https://cve.now/CVE-2025-68935.md): ONLYOFFICE Docs before 9.2.1 allows XSS via the Font field for the Multilevel list settings window. (CVSS 6.4, ONLYOFFICE Document Server)
- [CVE-2025-15085](https://cve.now/CVE-2025-15085.md): youlaitech youlai-mall Balance MemberController.java deductBalance improper authorization (CVSS 5.3, youlaitech youlai-mall)
- [CVE-2025-15084](https://cve.now/CVE-2025-15084.md): youlaitech youlai-mall Order Payment OrderController.java orderService.payOrder access control (CVSS 2.3, youlaitech youlai-mall)
- [CVE-2025-15083](https://cve.now/CVE-2025-15083.md): TOZED ZLT M30s UART on-chip debug and test interface with improper access control (CVSS 1.0, TOZED ZLT M30s)
- [CVE-2025-15082](https://cve.now/CVE-2025-15082.md): TOZED ZLT M30s Web Management proc\_post information disclosure (CVSS 6.9, TOZED ZLT M30s)
- [CVE-2025-15081](https://cve.now/CVE-2025-15081.md): JD Cloud BE6500 jdcapi sub\_4780 command injection (CVSS 5.3, JD Cloud BE6500)
- [CVE-2025-2307](https://cve.now/CVE-2025-2307.md): XSS in Verisay Communication's Aidango (CVSS 7.6, Verisay Communication and Information Technology Industry a…)
- [CVE-2025-2406](https://cve.now/CVE-2025-2406.md): XSS in Verisay Communication's Trizbi (CVSS 7.6, Verisay Communication and Information Technology Industry a…)
- [CVE-2025-2405](https://cve.now/CVE-2025-2405.md): XSS in Verisay Communication's Titarus (CVSS 7.6, Verisay Communication and Information Technology Industry a…)
- [CVE-2025-15078](https://cve.now/CVE-2025-15078.md): itsourcecode Student Management System list\_report.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2025-15077](https://cve.now/CVE-2025-15077.md): itsourcecode Student Management System form137.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2025-15076](https://cve.now/CVE-2025-15076.md): Tenda CH22 public path traversal (CVSS 6.9, Tenda CH22)
- [CVE-2025-15075](https://cve.now/CVE-2025-15075.md): itsourcecode Student Management System student\_p.php sql injection (CVSS 6.9, itsourcecode Student Management System)
- [CVE-2025-15074](https://cve.now/CVE-2025-15074.md): itsourcecode Online Frozen Foods Ordering System customer\_details.php sql injection (CVSS 6.9, itsourcecode Online Frozen Foods Ordering System)
- [CVE-2025-32095](https://cve.now/CVE-2025-32095.md): Pexip Infinity before 37.0 has improper input validation in signalling that allows a remote attacker to trigger a software abort via a craft (CVSS 7.5, Pexip Infinity)
- [CVE-2025-32096](https://cve.now/CVE-2025-32096.md): Pexip Infinity 33.0 through 37.0 before 37.1 has improper input validation in signaling that allows an attacker to trigger a software abort, (CVSS 7.5, Pexip Infinity)
- [CVE-2025-48704](https://cve.now/CVE-2025-48704.md): Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort (CVSS 7.5, Pexip Infinity)
- [CVE-2025-49088](https://cve.now/CVE-2025-49088.md): Pexip Infinity 32.0 through 37.1 before 37.2, in certain configurations of OTJ (One Touch Join) for Teams SIP Guest Join, has Improper Input (CVSS 5.9, Pexip Infinity)
- [CVE-2025-59683](https://cve.now/CVE-2025-59683.md): Pexip Infinity 15.0 through 38.0 before 38.1 has Improper Access Control in the Secure Scheduler for Exchange service, when used with Office (CVSS 8.2, Pexip Infinity)
- [CVE-2025-66377](https://cve.now/CVE-2025-66377.md): Pexip Infinity before 39.0 has Missing Authentication for a Critical Function in a product-internal API, allowing an attacker (who already h (CVSS 7.5, Pexip Infinity)
- [CVE-2025-66378](https://cve.now/CVE-2025-66378.md): Pexip Infinity 38.0 and 38.1 before 39.0 has insufficient access control in the RTMP implementation, allowing an attacker to disconnect RTMP (CVSS 5.9, Pexip Infinity)
- [CVE-2025-66379](https://cve.now/CVE-2025-66379.md): Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort (CVSS 7.5, Pexip Infinity)
- [CVE-2025-66443](https://cve.now/CVE-2025-66443.md): Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation (CVSS 7.5, Pexip Infinity)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-12-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.