# CVEs published 2025-12-28 44 CVEs were published on December 28, 2025: 0 critical, 6 high. Days are UTC. - [CVE-2025-15162](https://cve.now/CVE-2025-15162.md): Tenda WH450 RouteStatic stack-based overflow (CVSS 8.6, Tenda WH450) - [CVE-2025-15161](https://cve.now/CVE-2025-15161.md): Tenda WH450 PPTPUserSetting stack-based overflow (CVSS 8.6, Tenda WH450) - [CVE-2025-15160](https://cve.now/CVE-2025-15160.md): Tenda WH450 PPTPServer stack-based overflow (CVSS 8.6, Tenda WH450) - [CVE-2025-15156](https://cve.now/CVE-2025-15156.md): omec-project UPF PFCP Session Establishment Request messages\_session.go handleSessionEstablishmentRequest null pointer dereference (CVSS 5.3, omec-project UPF) - [CVE-2025-15155](https://cve.now/CVE-2025-15155.md): floooh sokol sokol\_gfx.h \_sg\_pipeline\_desc\_defaults stack-based overflow (CVSS 4.8, floooh sokol) - [CVE-2025-15154](https://cve.now/CVE-2025-15154.md): PbootCMS Header handle.php get\_user\_ip less trusted source (CVSS 6.9, PbootCMS) - [CVE-2025-15153](https://cve.now/CVE-2025-15153.md): PbootCMS SQLite Database pbootcms.db file access (CVSS 6.3, PbootCMS) - [CVE-2025-15152](https://cve.now/CVE-2025-15152.md): h-moses moga-mall PmsProductController.java addProduct unrestricted upload (CVSS 5.3, h-moses moga-mall) - [CVE-2025-15151](https://cve.now/CVE-2025-15151.md): TaleLin Lin-CMS Tests Folder config.py password in configuration file (CVSS 6.3, TaleLin Lin-CMS) - [CVE-2025-15150](https://cve.now/CVE-2025-15150.md): PX4 PX4-Autopilot mavlink\_log\_handler.cpp log\_entry\_from\_id stack-based overflow (CVSS 4.8, PX4-Autopilot) - [CVE-2025-15149](https://cve.now/CVE-2025-15149.md): rawchen ecms Add New Product updateProductServlet.java updateProductServlet cross site scripting (CVSS 4.8, rawchen ecms) - [CVE-2025-15148](https://cve.now/CVE-2025-15148.md): CmsEasy Backend Template Management template\_admin.php savetemp\_action code injection (CVSS 5.1, CmsEasy) - [CVE-2025-15146](https://cve.now/CVE-2025-15146.md): SohuTV CacheCloud UserManageController.java doUserList cross site scripting (CVSS 4.8, SohuTV CacheCloud) - [CVE-2025-15145](https://cve.now/CVE-2025-15145.md): SohuTV CacheCloud TotalManageController.java doTotalList cross site scripting (CVSS 4.8, SohuTV CacheCloud) - [CVE-2025-15144](https://cve.now/CVE-2025-15144.md): dayrui XunRuiCMS JSONP Callback Init.php dr\_exit\_msg cross site scripting (CVSS 5.3, dayrui XunRuiCMS) - [CVE-2025-68973](https://cve.now/CVE-2025-68973.md): In GnuPG before 2.4.9, armor\_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bound (CVSS 7.8, GnuPG) - [CVE-2025-15143](https://cve.now/CVE-2025-15143.md): EyouCMS Backend Template Management FilemanagerLogic.php sql injection (CVSS 5.1, EyouCMS) - [CVE-2025-15142](https://cve.now/CVE-2025-15142.md): 9786 phpok3w show.php sql injection (CVSS 6.9, 9786 phpok3w) - [CVE-2025-15141](https://cve.now/CVE-2025-15141.md): Halo Configuration actuator information disclosure (CVSS 2.3, Halo) - [CVE-2025-15140](https://cve.now/CVE-2025-15140.md): saiftheboss7 onlinemcqexam quesadd.php sql injection (CVSS 6.9, saiftheboss7 onlinemcqexam) - [CVE-2025-15139](https://cve.now/CVE-2025-15139.md): TRENDnet TEW-822DRE formWsc sub\_43ACF4 command injection (CVSS 5.3, TRENDnet TEW-822DRE) - [CVE-2025-15138](https://cve.now/CVE-2025-15138.md): prasathmani TinyFileManager tinyfilemanager.php path traversal (CVSS 5.1, prasathmani TinyFileManager) - [CVE-2025-15137](https://cve.now/CVE-2025-15137.md): TRENDnet TEW-800MB NTPSyncWithHost.cgi sub\_F934 command injection (CVSS 8.7, TRENDnet TEW-800MB) - [CVE-2025-15136](https://cve.now/CVE-2025-15136.md): TRENDnet TEW-800MB Management wizardset do\_setWizard\_asp command injection (CVSS 8.7, TRENDnet TEW-800MB) - [CVE-2025-15135](https://cve.now/CVE-2025-15135.md): joey-zhou xiaozhi-esp32-server-java Cookie AuthenticationInterceptor.java tryAuthenticateWithCookies improper authentication (CVSS 5.3, joey-zhou xiaozhi-esp32-server-java) - [CVE-2025-15134](https://cve.now/CVE-2025-15134.md): yourmaileyes MOOC Submission MainController.java subreview cross site scripting (CVSS 5.1, yourmaileyes MOOC) - [CVE-2025-15133](https://cve.now/CVE-2025-15133.md): ZSPACE Z4Pro+ HTTP POST Request close zfilev2\_api\_CloseSafe command injection (CVSS 5.3, ZSPACE Z4Pro+) - [CVE-2025-15132](https://cve.now/CVE-2025-15132.md): ZSPACE Z4Pro+ HTTP POST Request open zfilev2\_api\_open command injection (CVSS 5.3, ZSPACE Z4Pro+) - [CVE-2025-15131](https://cve.now/CVE-2025-15131.md): ZSPACE Z4Pro+ HTTP POST Request status zfilev2\_api\_SafeStatus command injection (CVSS 5.3, ZSPACE Z4Pro+) - [CVE-2025-15130](https://cve.now/CVE-2025-15130.md): shanyu SyCms Administrative Panel FileManageController.class.php addPost code injection (CVSS 5.1, shanyu SyCms) - [CVE-2025-15129](https://cve.now/CVE-2025-15129.md): ChenJinchuang Lin-CMS-TP5 File Upload LocalUploader.php upload code injection (CVSS 5.3, ChenJinchuang Lin-CMS-TP5) - [CVE-2025-15128](https://cve.now/CVE-2025-15128.md): ZKTeco BioTime Endpoint safe\_setting credentials storage (CVSS 6.9, ZKTeco BioTime) - [CVE-2025-15127](https://cve.now/CVE-2025-15127.md): FantasticLBP Hotels\_Server Room.php sql injection (CVSS 6.9, FantasticLBP Hotels\_Server) - [CVE-2025-15126](https://cve.now/CVE-2025-15126.md): JeecgBoot getPositionUserList improper authorization (CVSS 2.3, JeecgBoot) - [CVE-2025-15125](https://cve.now/CVE-2025-15125.md): JeecgBoot queryDepartPermission improper authorization (CVSS 2.3, JeecgBoot) - [CVE-2025-15124](https://cve.now/CVE-2025-15124.md): JeecgBoot list getParameterMap improper authorization (CVSS 2.3, JeecgBoot) - [CVE-2025-15123](https://cve.now/CVE-2025-15123.md): JeecgBoot datarule improper authorization (CVSS 2.3, JeecgBoot) - [CVE-2025-15122](https://cve.now/CVE-2025-15122.md): JeecgBoot datarule loadDatarule improper authorization (CVSS 2.3, JeecgBoot) - [CVE-2025-15121](https://cve.now/CVE-2025-15121.md): JeecgBoot getDeptRoleByUserId information disclosure (CVSS 4.8, JeecgBoot) - [CVE-2025-15120](https://cve.now/CVE-2025-15120.md): JeecgBoot getDeptRoleList improper authorization (CVSS 2.3, JeecgBoot) - [CVE-2025-15119](https://cve.now/CVE-2025-15119.md): JeecgBoot list queryPageList improper authorization (CVSS 2.3, JeecgBoot) - [CVE-2025-15118](https://cve.now/CVE-2025-15118.md): macrozheng mall Member Endpoint update improper authorization (CVSS 5.3, macrozheng mall) - [CVE-2025-15117](https://cve.now/CVE-2025-15117.md): Dromara Sa-Token SaJdkSerializer.java ObjectInputStream.readObject deserialization (CVSS 2.3, Dromara Sa-Token) - [CVE-2025-15116](https://cve.now/CVE-2025-15116.md): OpenCart Single-Use Coupon race condition (CVSS 6.3, OpenCart) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-12-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.