CVEs published December 29, 2025
130 CVEs were published on December 29, 2025: 15 critical, 40 high. 1 is now in CISA KEV.
- Published
- 130
- Critical
- 15
- High
- 40
- Medium
- 74
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 25
Most affected products
- SohuTV CacheCloud
- 10
- code-projects Refugee Food Management System
- 9
- Tenda WH450
- 6
- D-Link DWR-M920
- 5
- Priority Web
- 5
- Gmission Web Fax
- 3
- itsourcecode Online Cake Ordering System
- 3
- Campcodes Supplier Management System
- 2
- code-projects Assessment Management
- 2
- code-projects College Notes Uploading System
- 2
Critical 15
- CVE-2025-68562WordPress MapSVG plugin <= 8.7.3 - Arbitrary File Upload vulnerabilityRomanCode MapSVG
- CVE-2025-68860WordPress Mobile builder plugin <= 1.4.2 - Broken Authentication vulnerabilityMobile builder
- CVE-2025-68897WordPress IF AS Shortcode plugin <= 1.2 - Remote Code Execution (RCE) vulnerabilityMohammad I. Okfie IF AS Shortcode
- CVE-2025-15194D-Link DIR-600 HTTP Header hedwig.cgi stack-based overflowD-Link DIR-600
- CVE-2025-68929Frappe may be vulnerable remote code execution due to server-side template injectionfrappe
- CVE-2025-15228WELLTEND TECHNOLOGY｜ BPMFlowWebkit - Arbitrary File UploadWELLTEND TECHNOLOGY BPMFlowWebkit
- CVE-2025-15226Sunnet｜WMPro - Arbitrary File UploadSunnet WMPro
- CVE-2025-52691Upload Arbitrary FilesSmarterTools SmarterMail
- CVE-2024-25181A critical vulnerability has been identified in givanz VvvebJs 1.7.2, which allows both Server-Side Request Forgery (SSRF) and arbitrary fil
- CVE-2024-25182givanz VvvebJs 1.7.2 suffers from a File Upload vulnerability via save.php.
- CVE-2024-27480givanz VvvebJs 1.7.2 is vulnerable to Insecure File Upload.
- CVE-2025-56333An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component
- CVE-2025-57460File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.
- CVE-2025-65570A type confusion in jsish 2.0 allows incorrect control flow during execution of the OP_NEXT opcode.
- CVE-2025-68706A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13.
High 40
- CVE-2025-23554WordPress Off Page SEO plugin <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerabilityJakub Glos Off Page SEO
- CVE-2025-23550WordPress Product Puller plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerabilityKemal YAZICI Product Puller
- CVE-2025-23469WordPress Sleekplan plugin <= 0.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySleekplan
- CVE-2025-23458WordPress Ads24 Lite plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityRakessh Ads24 Lite
- CVE-2025-68036WordPress CubeWP plugin <= 1.1.27 - Broken Access Control vulnerabilityImran Tauqeer CubeWP
- CVE-2025-13592Advanced Ads <= 2.0.14 - Authenticated (Editor+) Remote Code Execution via Shortcodemonetizemore Advanced Ads – Ad Manager & AdSense
- CVE-2025-68861WordPress Plugin Optimizer plugin <= 1.3.7 - Broken Access Control vulnerabilitypluginoptimizer Plugin Optimizer
- CVE-2025-55061Priority - CWE-434 Unrestricted Upload of File with Dangerous TypePriority Web
- CVE-2025-68870WordPress CookieHint WP plugin <= 1.0.0 - Local File Inclusion vulnerabilityreDim CookieHint WP
- CVE-2025-68876WordPress Invelity SPS connect plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerabilityInvelity SPS connect
- CVE-2025-68877WordPress CedCommerce Integration for Good Market plugin <= 1.0.6 - Local File Inclusion vulnerabilityCedCommerce Integration for Good Market
- CVE-2025-68878WordPress Advanced Custom CSS plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityprasadkirpekar Advanced Custom CSS
- CVE-2025-68879WordPress Content Grid Slider plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilitycouncilsoft Content Grid Slider
- CVE-2025-69201Tugtainer has RCE in Agent Command Execution ApiQuenary tugtainer
- CVE-2025-69200phpMyFAQ has unauthenticated config backup download via /api/setup/backupthorsten phpMyFAQ · thorsten/phpmyfaq
- CVE-2025-15193D-Link DWR-M920 formParentControl sub_423848 buffer overflowD-Link DWR-M920
- CVE-2025-15190D-Link DWR-M920 formFilter sub_42261C stack-based overflowD-Link DWR-M920
- CVE-2025-15189D-Link DWR-M920 formDefRoute sub_464794 buffer overflowD-Link DWR-M920
- CVE-2025-15180Tenda WH450 HTTP Request webExcptypemanFilte stack-based overflowTenda WH450
- CVE-2025-15179Tenda WH450 qossetting stack-based overflowTenda WH450
- CVE-2025-15178Tenda WH450 HTTP Request VirtualSer stack-based overflowTenda WH450
- CVE-2025-15227WELLTEND TECHNOLOGY｜ BPMFlowWebkit - Arbitrary File ReadWELLTEND TECHNOLOGY BPMFlowWebkit
- CVE-2025-15177Tenda WH450 HTTP Request SetIpBind stack-based overflowTenda WH450
- CVE-2025-15225Sunnet｜WMPro - Arbitrary File ReadSunnet WMPro
- CVE-2025-13417Plugin Organizer < 10.2.4 - Subscriber+ SQLiPlugin Organizer
- CVE-2025-15069Privilege Escalation in Gmission Web FAXGmission Web Fax
- CVE-2025-15068Account Takeover in Gmission Web FAXGmission Web Fax
- CVE-2025-15067Unrestricted File Upload and RCE in Innorix WPInnorix WP
- CVE-2025-15164Tenda WH450 SafeMacFilter stack-based overflowTenda WH450
- CVE-2025-15065Data Exposure in Kings Information & Network KESS EnterpriseKings Information & Network KESS Enterprise
- CVE-2025-15163Tenda WH450 SafeEmailFilter stack-based overflowTenda WH450
- CVE-2024-25183givanz VvvebJs 1.7.2 is vulnerable to Directory Traversal via scan.php.
- CVE-2024-30855DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /src/dede/makehtml_list_action.php.
- CVE-2025-66862A buffer overflow vulnerability in function gnu_special in file cplus-dem.c in BinUtils 2.26 allows attackers to cause a denial of service v
- CVE-2025-66863An issue was discovered in function d_discriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via
- CVE-2025-66865An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service
- CVE-2025-66869Buffer overflow vulnerability in function strcat in asan_interceptors.cpp in libming 0.4.8.
- CVE-2025-66877Buffer overflow vulnerability in function dcputchar in decompile.c in libming 0.4.8.
- CVE-2025-67254NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php.
- CVE-2025-67255In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Inject
Medium, low and unrated 75
- CVE-2025-68120Unexpected untrusted code execution in github.com/golang/vscode-gogithub.com/golang/vscode-go
- CVE-2025-15210code-projects Refugee Food Management System editrefugee.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-68040WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerabilityweDevs WP Project Manager
- CVE-2023-41656WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerabilitywpdive Better Elementor Addons
- CVE-2023-32238WordPress TheGem theme < 5.8.1.1 - Broken Access Control vulnerabilityCodexThemes TheGem
- CVE-2025-68498WordPress JetTabs plugin <= 2.2.12 - Broken Access Control vulnerabilityCrocoblock JetTabs
- CVE-2025-68499WordPress JetTabs plugin <= 2.2.12 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetTabs
- CVE-2025-15209code-projects Refugee Food Management System editfood.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15284arrayLimit bypass in bracket notation allows DoS via memory exhaustionqs
- CVE-2025-15208code-projects Refugee Food Management System editrefugee.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15207Campcodes Supplier Management System view_products.php sql injectionCampcodes Supplier Management System
- CVE-2025-15206Campcodes Supplier Management System add_area.php sql injectionCampcodes Supplier Management System
- CVE-2025-68502WordPress JetPopup plugin <= 2.0.20.1 - Insecure Direct Object References (IDOR) vulnerabilityCrocoblock JetPopup
- CVE-2025-68503WordPress JetBlog plugin <= 2.4.7 - Broken Access Control vulnerabilityCrocoblock JetBlog
- CVE-2025-68504WordPress JetSearch plugin <= 3.5.16 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetSearch
- CVE-2025-68607WordPress Custom Field Template plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerabilityHiroaki Miyashita Custom Field Template
- CVE-2025-15205code-projects Student File Management System download.php sql injectioncode-projects Student File Management System
- CVE-2025-69205In µURU, a Specially Crafted Federation Name Allows Dialplan Injectionolell uURU
- CVE-2025-15204SohuTV CacheCloud QuartzManageController.java doQuartzList cross site scriptingSohuTV CacheCloud
- CVE-2025-15203SohuTV CacheCloud ResourceController.java index cross site scriptingSohuTV CacheCloud
- CVE-2025-15202SohuTV CacheCloud TaskController.java taskQueueList cross site scriptingSohuTV CacheCloud
- CVE-2025-14175Weak Algorithm Support in SSH Server on TL-WR820NTP-Link Systems TL-WR820N
- CVE-2025-69202axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Headerarthurfiorette axios-cache-interceptor · axios-cache-interc…
- CVE-2025-68431libheif has Potential Heap Buffer Over-Readstrukturag libheif
- CVE-2025-14728Rapid7 Velociraptor Directory Traversal VulnerabilityRapid7 Velociraptor
- CVE-2025-15201SohuTV CacheCloud WebResourceController.java redirectNoPower cross site scriptingSohuTV CacheCloud
- CVE-2025-15200SohuTV CacheCloud AppClientDataShowController.java doIndex cross site scriptingSohuTV CacheCloud
- CVE-2025-14280PixelYourSite <= 11.1.5 - Sensitive Information Exposure via Log FilePixelYourSite – Your smart PIXEL (TAG) & API Manager
- CVE-2025-15199code-projects College Notes Uploading System userprofile.php unrestricted uploadcode-projects College Notes Uploading System
- CVE-2025-15198code-projects College Notes Uploading System login.php sql injectioncode-projects College Notes Uploading System
- CVE-2025-55064Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Priority Web
- CVE-2025-55063Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Priority Web
- CVE-2025-55062Priority - CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')Priority Web
- CVE-2025-55060Priority - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')Priority Web
- CVE-2025-15197code-projects/anirbandutta9 Content Management System/News-Buzz editposts.php unrestricted uploadcode-projects Content Management System · code-projects… +2
- CVE-2025-15196code-projects Assessment Management login.php sql injectioncode-projects Assessment Management
- CVE-2025-53627Meshtastic firmware allows forged DMs with no PKC to show up as encryptedmeshtastic firmware
- CVE-2025-68868WordPress Wp Text Slider Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitycodeaffairs Wp Text Slider Widget
- CVE-2025-15195code-projects Assessment Management add-module.php sql injectioncode-projects Assessment Management
- CVE-2025-69211Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)nestjs nest · @nestjs/platform-fastify
- CVE-2025-68893WordPress WordPress Image shrinker plugin <= 1.1.0 - Server Side Request Forgery (SSRF) vulnerabilityHETWORKS WordPress Image shrinker
- CVE-2025-69206Hemmelig has SSRF Filter bypass in Secret Request functionalityHemmeligOrg Hemmelig.app · hemmelig
- CVE-2025-68951phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |rawthorsten phpMyFAQ · thorsten/phpmyfaq
- CVE-2025-68928Frappe CRM vulnerable to authenticated XSS via website fieldfrappe crm
- CVE-2025-15192D-Link DWR-M920 formLtefotaUpgradeQuectel sub_415328 command injectionD-Link DWR-M920
- CVE-2025-15191D-Link DWR-M920 formLtefotaUpgradeFibocom sub_4155B4 command injectionD-Link DWR-M920
- CVE-2025-15188Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scriptingCampcodes Complete Online Beauty Parlor Management System
- CVE-2025-15187GreenCMS File DataController.class.php path traversalGreenCMS
- CVE-2025-15186code-projects Refugee Food Management System addusers.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15185code-projects Refugee Food Management System refugeesreport.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15184code-projects Refugee Food Management System refugeesreport2.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15183code-projects Refugee Food Management System viewtakenfd.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15182code-projects Refugee Food Management System served.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15181code-projects Refugee Food Management System pagenateRefugeesList.php sql injectioncode-projects Refugee Food Management System
- CVE-2025-15176Open5GS PFCP Session Establishment Request rule-match.c ogs_pfcp_pdr_rule_find_by_packet assertionOpen5GS
- CVE-2025-15175SohuTV CacheCloud AppController.java appCommandAnalysis cross site scriptingSohuTV CacheCloud
- CVE-2025-13958YaMaps < 0.6.40 - Contributor+ Stored XSSYaMaps for WordPress Plugin
- CVE-2025-15174SohuTV CacheCloud AppManageController.java doAppAuditList cross site scriptingSohuTV CacheCloud
- CVE-2025-15070Data Exposure in Gmission Web FAXGmission Web Fax
- CVE-2025-15173SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scriptingSohuTV CacheCloud
- CVE-2025-15172SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scriptingSohuTV CacheCloud
- CVE-2025-15171SohuTV CacheCloud ServerController.java index cross site scriptingSohuTV CacheCloud
- CVE-2025-15170Advaya Softech GEMS ERP Portal Error Message home.jsp cross site scriptingAdvaya Softech GEMS ERP Portal
- CVE-2025-15169BiggiDroid Simple PHP CMS editsite.php sql injectionBiggiDroid Simple PHP CMS
- CVE-2025-15168itsourcecode Student Management System statistical.php sql injectionitsourcecode Student Management System
- CVE-2025-15167itsourcecode Online Cake Ordering System detailtransac.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2025-15166itsourcecode Online Cake Ordering System updatesupplier.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2025-15165itsourcecode Online Cake Ordering System updatecustomer.php sql injectionitsourcecode Online Cake Ordering System
- CVE-2025-15066Arbitrary File Download through Path Traversal in Innorix WPInnorix WP
- CVE-2025-57462Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF fi
- CVE-2025-60458UxPlay 1.72 contains a double free vulnerability in its RTSP request handling.
- CVE-2025-65442DOM-based Cross-Site Scripting (XSS) vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or
- CVE-2025-66861An issue was discovered in function d_unqualified_name in file cp-demangle.c in BinUtils 2.26 allowing attackers to cause a denial of servic
- CVE-2025-66864An issue was discovered in function d_print_comp_inner in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service
- CVE-2025-66866An issue was discovered in function d_abi_tags in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via craf