CVEs published December 28, 2025
44 CVEs were published on December 28, 2025: 0 critical, 6 high.
- Published
- 44
- Critical
- 0
- High
- 6
- Medium
- 29
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- JeecgBoot
- 8
- Tenda WH450
- 3
- ZSPACE Z4Pro+
- 3
- PbootCMS
- 2
- SohuTV CacheCloud
- 2
- TRENDnet TEW-800MB
- 2
- 9786 phpok3w
- 1
- ChenJinchuang Lin-CMS-TP5
- 1
- CmsEasy
- 1
- dayrui XunRuiCMS
- 1
High 6
- CVE-2025-15162Tenda WH450 RouteStatic stack-based overflowTenda WH450
- CVE-2025-15161Tenda WH450 PPTPUserSetting stack-based overflowTenda WH450
- CVE-2025-15160Tenda WH450 PPTPServer stack-based overflowTenda WH450
- CVE-2025-68973In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-boundGnuPG
- CVE-2025-15137TRENDnet TEW-800MB NTPSyncWithHost.cgi sub_F934 command injectionTRENDnet TEW-800MB
- CVE-2025-15136TRENDnet TEW-800MB Management wizardset do_setWizard_asp command injectionTRENDnet TEW-800MB
Medium, low and unrated 38
- CVE-2025-15156omec-project UPF PFCP Session Establishment Request messages_session.go handleSessionEstablishmentRequest null pointer dereferenceomec-project UPF
- CVE-2025-15155floooh sokol sokol_gfx.h _sg_pipeline_desc_defaults stack-based overflowfloooh sokol
- CVE-2025-15154PbootCMS Header handle.php get_user_ip less trusted sourcePbootCMS
- CVE-2025-15153PbootCMS SQLite Database pbootcms.db file accessPbootCMS
- CVE-2025-15152h-moses moga-mall PmsProductController.java addProduct unrestricted uploadh-moses moga-mall
- CVE-2025-15151TaleLin Lin-CMS Tests Folder config.py password in configuration fileTaleLin Lin-CMS
- CVE-2025-15150PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflowPX4-Autopilot
- CVE-2025-15149rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scriptingrawchen ecms
- CVE-2025-15148CmsEasy Backend Template Management template_admin.php savetemp_action code injectionCmsEasy
- CVE-2025-15146SohuTV CacheCloud UserManageController.java doUserList cross site scriptingSohuTV CacheCloud
- CVE-2025-15145SohuTV CacheCloud TotalManageController.java doTotalList cross site scriptingSohuTV CacheCloud
- CVE-2025-15144dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scriptingdayrui XunRuiCMS
- CVE-2025-15143EyouCMS Backend Template Management FilemanagerLogic.php sql injectionEyouCMS
- CVE-2025-151429786 phpok3w show.php sql injection9786 phpok3w
- CVE-2025-15141Halo Configuration actuator information disclosureHalo
- CVE-2025-15140saiftheboss7 onlinemcqexam quesadd.php sql injectionsaiftheboss7 onlinemcqexam
- CVE-2025-15139TRENDnet TEW-822DRE formWsc sub_43ACF4 command injectionTRENDnet TEW-822DRE
- CVE-2025-15138prasathmani TinyFileManager tinyfilemanager.php path traversalprasathmani TinyFileManager
- CVE-2025-15135joey-zhou xiaozhi-esp32-server-java Cookie AuthenticationInterceptor.java tryAuthenticateWithCookies improper authenticationjoey-zhou xiaozhi-esp32-server-java
- CVE-2025-15134yourmaileyes MOOC Submission MainController.java subreview cross site scriptingyourmaileyes MOOC
- CVE-2025-15133ZSPACE Z4Pro+ HTTP POST Request close zfilev2_api_CloseSafe command injectionZSPACE Z4Pro+
- CVE-2025-15132ZSPACE Z4Pro+ HTTP POST Request open zfilev2_api_open command injectionZSPACE Z4Pro+
- CVE-2025-15131ZSPACE Z4Pro+ HTTP POST Request status zfilev2_api_SafeStatus command injectionZSPACE Z4Pro+
- CVE-2025-15130shanyu SyCms Administrative Panel FileManageController.class.php addPost code injectionshanyu SyCms
- CVE-2025-15129ChenJinchuang Lin-CMS-TP5 File Upload LocalUploader.php upload code injectionChenJinchuang Lin-CMS-TP5
- CVE-2025-15128ZKTeco BioTime Endpoint safe_setting credentials storageZKTeco BioTime
- CVE-2025-15127FantasticLBP Hotels_Server Room.php sql injectionFantasticLBP Hotels_Server
- CVE-2025-15126JeecgBoot getPositionUserList improper authorizationJeecgBoot
- CVE-2025-15125JeecgBoot queryDepartPermission improper authorizationJeecgBoot
- CVE-2025-15124JeecgBoot list getParameterMap improper authorizationJeecgBoot
- CVE-2025-15123JeecgBoot datarule improper authorizationJeecgBoot
- CVE-2025-15122JeecgBoot datarule loadDatarule improper authorizationJeecgBoot
- CVE-2025-15121JeecgBoot getDeptRoleByUserId information disclosureJeecgBoot
- CVE-2025-15120JeecgBoot getDeptRoleList improper authorizationJeecgBoot
- CVE-2025-15119JeecgBoot list queryPageList improper authorizationJeecgBoot
- CVE-2025-15118macrozheng mall Member Endpoint update improper authorizationmacrozheng mall
- CVE-2025-15117Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserializationDromara Sa-Token
- CVE-2025-15116OpenCart Single-Use Coupon race conditionOpenCart