Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
38,658 results · page 204 of 774
Dec 18, 2025WatchGuard Firebox Out of Bounds Write VulnerabilityCVE-2025-14733 · Network & remote access · WatchGuard · reported by 5d1c2695-1a31-4499-88ae-e847036fd7e3ExploitedRansomwareCritical 9.3
WatchGuard Fireware OS iked process contains an out of bounds write vulnerability in the OS iked process. This vulnerability may allow a remote unauthenticated attacker to execute arbitrary code and affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer.
- Product
- Firebox
- On CISA’s list since
- Dec 19, 2025 (federal fix deadline Dec 26, 2025)
- What to do
- Attackers are using this now. Install WatchGuard’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpsirt.watchguard.comwatchguard.com
Dec 18, 2025Weblate is a web based localization tool.CVE-2025-68398 · Other software · WeblateOrg · reported by GitHubCritical 9.1
Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.
- Product
- weblate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.CVE-2025-65041 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
- Product
- Microsoft Partner Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network.CVE-2025-65037 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 10
Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network.
- Product
- Azure Container Apps
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Custom Question Answering Elevation of Privilege VulnerabilityCVE-2025-64663 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.9
Custom Question Answering Elevation of Privilege Vulnerability
- Product
- Azure Cognitive Service for Language
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server.CVE-2023-53942 · Other software · leefish · reported by VulnCheckCritical 9.4
File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.
- Product
- File Thingie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Dec 18, 2025EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by injecting maCVE-2023-53941 · Other software · Easyphp · reported by VulnCheckCritical 9.3
EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by injecting malicious payloads through the app_service_control parameter. Attackers can send POST requests to /index.php?zone=settings with crafted app_service_control values to execute commands with administrative privileges.
- Product
- EasyPHP Webserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordeasyphp.orgexploit-db.com
Dec 18, 2025Default credentials in Dify thru 1.5.1.CVE-2025-56157 · Other software · Langgenius · reported by MITRECritical 9.8
Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.
- Product
- Dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 18, 2025Tuturn: Authentication Bypass Using an Alternate Path or ChannelCVE-2025-64236 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a before 3.6.
- Product
- Tuturn
- Fixed in
- 3.6
- What to do
- Update Tuturn to 3.6 or newer.
Dec 18, 2025A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3.CVE-2025-63389 · Other software · Ollama · reported by MITRECritical 9.8
A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations.
- Product
- Ollama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 18, 2025A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint.CVE-2025-63388 · Other software · Langgenius · reported by MITRECritical 9.1
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additional access compared to unauthenticated requests."
- Product
- Dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 18, 2025A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint.CVE-2025-63386 · Other software · Langgenius · reported by MITRECritical 9.1
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains to make authenticated requests. NOTE: the Supplier disputes this because the endpoint configuration is intentional to support bootstrap.
- Product
- Dify
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Dec 18, 2025In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious attaCVE-2025-65008 · Other software · WODESYS · reported by cvd@cert.plCritical 9.4
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious attacker can execute system shell commands. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version WDR28081123OV1.01 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
- Product
- WD-R608U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Use-after-free in the Disability Access APIs component.CVE-2025-14860 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgCritical 9.8
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 18, 2025A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account,CVE-2025-10910 · Other software · Govee · reported by cvd@cert.plCritical 9.3
A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account, resulting in full control of the device and removal of the device from its legitimate owner’s account. The server‑side API allows device association using a set of identifiers: "device", "sku", "type", and a client‑computed "value", that are not cryptographically bound to a secret originating from the device itself. The vulnerability has been verified for the Govee H6056 - lamp device in firmware version 1.08.13, but may affect also other Govee cloud‑connected devices. The vendor is investigating other potentially affected models. The vendor has deployed server-side security enhancements and automatic firmware updates for model H6056. Most of H6056 devices have been successfully patched through automatic updates. Remaining H6056 users with upgradeable hardware versions must manually update firmware through the Govee Home app while keeping their device WiFi-connected. Users should open the Govee Home app, tap their H6056 device card to enter the device details page, tap the settings icon in the upper right corner, navigate
- Product
- H6056
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Hotel Booking Lite: Improper Control of Generation of Code ('Code Injection')CVE-2025-66078 · WordPress plugins & themes · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3.
- Product
- Hotel Booking Lite
- Affected
- up to 5.2.3
- What to do
- Affects up to 5.2.3. Update Hotel Booking Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Webhooks: Unrestricted Upload of File with Dangerous TypeCVE-2025-66074 · WordPress plugins & themes · reported by PatchstackCritical 9
Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from n/a through <= 3.3.8.
- Product
- WP Webhooks
- Affected
- up to 3.3.8
- What to do
- Affects up to 3.3.8. Update WP Webhooks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Motors: Unrestricted Upload of File with Dangerous TypeCVE-2025-64374 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a through <= 5.6.81.
- Product
- Motors
- Affected
- up to 5.6.81
- What to do
- Affects up to 5.6.81. Update Motors to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Codiqa: Deserialization of Untrusted DataCVE-2025-64233 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.
- Product
- Codiqa
- What to do
- Update Codiqa to the newest version.
Dec 18, 2025WordPress Contact Form 7 PDF, Google Sheet & Database: Unrestricted Upload of File with Dangerous TypeCVE-2025-64231 · WordPress plugins & themes · reported by PatchstackCritical 9.9
Unrestricted Upload of File with Dangerous Type vulnerability in RedefiningTheWeb WordPress Contact Form 7 PDF, Google Sheet & Database rtwwcfp-wordpress-contact-form-7-pdf allows Using Malicious Files.This issue affects WordPress Contact Form 7 PDF, Google Sheet & Database: from n/a through <= 3.0.0.
- Product
- WordPress Contact Form 7 PDF, Google Sheet & Database
- Affected
- up to 3.0.0
- What to do
- Affects up to 3.0.0. Update WordPress Contact Form 7 PDF, Google Sheet & Database to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Client Invoicing by Sprout Invoices: Deserialization of Untrusted DataCVE-2025-64227 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Object Injection.This issue affects Client Invoicing by Sprout Invoices: from n/a through <= 20.8.7.
- Product
- Client Invoicing by Sprout Invoices
- Affected
- up to 20.8.7
- What to do
- Affects up to 20.8.7. Update Client Invoicing by Sprout Invoices to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Jannah: Deserialization of Untrusted DataCVE-2025-64206 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in TieLabs Jannah jannah allows Object Injection.This issue affects Jannah: from n/a through <= 7.6.0.
- Product
- Jannah
- Affected
- up to 7.6.0
- What to do
- Affects up to 7.6.0. Update Jannah to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Soledad: Incorrect Privilege AssignmentCVE-2025-64188 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Incorrect Privilege Assignment vulnerability in PenciDesign Soledad soledad allows Privilege Escalation.This issue affects Soledad: from n/a through <= 8.6.9.
- Product
- Soledad
- Affected
- up to 8.6.9
- What to do
- Affects up to 8.6.9. Update Soledad to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms Salesforce: Deserialization of Untrusted DataCVE-2025-60180 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Object Injection.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.5.1.
- Product
- WP Gravity Forms Salesforce
- Affected
- up to 1.5.1
- What to do
- Affects up to 1.5.1. Update WP Gravity Forms Salesforce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms HubSpot: Deserialization of Untrusted DataCVE-2025-60178 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Object Injection.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.6.
- Product
- WP Gravity Forms HubSpot
- Affected
- up to 1.2.6
- What to do
- Affects up to 1.2.6. Update WP Gravity Forms HubSpot to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms Constant Contact: Deserialization of Untrusted DataCVE-2025-60174 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Object Injection.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.2.
- Product
- WP Gravity Forms Constant Contact
- Affected
- up to 1.1.2
- What to do
- Affects up to 1.1.2. Update WP Gravity Forms Constant Contact to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms Zoho CRM and Bigin: Deserialization of Untrusted DataCVE-2025-60091 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.
- Product
- WP Gravity Forms Zoho CRM and Bigin
- Affected
- up to 1.2.9
- What to do
- Affects up to 1.2.9. Update WP Gravity Forms Zoho CRM and Bigin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms Insightly: Deserialization of Untrusted DataCVE-2025-60090 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through <= 1.1.6.
- Product
- WP Gravity Forms Insightly
- Affected
- up to 1.1.6
- What to do
- Affects up to 1.1.6. Update WP Gravity Forms Insightly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025WP Gravity Forms FreshDesk: Deserialization of Untrusted DataCVE-2025-60089 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.
- Product
- WP Gravity Forms FreshDesk
- Affected
- up to 1.3.5
- What to do
- Affects up to 1.3.5. Update WP Gravity Forms FreshDesk to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025tPlayer: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-60062 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mmetrodw tPlayer tplayer-html5-audio-player-with-playlist allows SQL Injection.This issue affects tPlayer: from n/a through <= 1.2.1.6.
- Product
- tPlayer
- Affected
- up to 1.2.1.6
- What to do
- Affects up to 1.2.1.6. Update tPlayer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Advance Seat Reservation Management for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58951 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Advance Seat Reservation Management for WooCommerce scw-seat-reservation allows SQL Injection.This issue affects Advance Seat Reservation Management for WooCommerce: from n/a through <= 3.1.
- Product
- Advance Seat Reservation Management for WooCommerce
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Advance Seat Reservation Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025DentiCare: Deserialization of Untrusted DataCVE-2025-54723 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4.3.
- Product
- DentiCare
- What to do
- Update DentiCare to the newest version.
Dec 18, 2025EasyEat: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-53433 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes EasyEat easyeat allows PHP Local File Inclusion.This issue affects EasyEat: from n/a through <= 1.9.0.
- Product
- EasyEat
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update EasyEat to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 18, 2025Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.CVE-2025-47372 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comCritical 9
Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.
- Product
- Snapdragon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middlewareCVE-2025-68435 · Other software · nicotsx · reported by GitHubCritical 9.1
Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middleware is not properly applied to API endpoints. This results in certain API endpoints being accessible without valid session credentials. This is dangerous for those who have exposed Zerobyte to be used outside of their internal network. A fix has been applied in both version 0.19.0 and 0.18.5. If immediate upgrade is not possible, restrict network access to the Zerobyte instance to trusted networks only using firewall rules or network segmentation. This is only a temporary mitigation; upgrading is strongly recommended.
- Product
- zerobyte
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController eCVE-2023-53923 · Other software · Ulicms · reported by VulnCheckCritical 9.3
UliCMS 2023.1 contains a privilege escalation vulnerability that allows unauthenticated attackers to create administrative accounts through the UserController endpoint. Attackers can send a crafted POST request to /dist/admin/index.php with specific parameters to generate a new admin user with full system access.
- Product
- Ulicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Dec 17, 2025TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PCVE-2023-53922 · Other software · TinyWebGallery · reported by VulnCheckCritical 9.3
TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.
- Product
- TinyWebGallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtinywebgallery.comexploit-db.com
Dec 17, 2025UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserConCVE-2023-53914 · Other software · ulicms · reported by VulnCheckCritical 9.3
UliCMS 2023.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through mass assignment in the UserController. Attackers can send a crafted POST request to the admin index.php endpoint with specific parameters to generate an administrative account with full system access.
- Product
- Ulicms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordweb.archive.orgexploit-db.com
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68400 · Other software · ChurchCRM · reported by GitHubCritical 9.3
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed and reachable directly via URL. This is a classic case of *dead but reachable code*. Any authenticated user - including one with zero assigned permissions - can exploit SQL injection through the `familyId` parameter. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68275 · Other software · ChurchCRM · reported by GitHubCritical 9.2
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnerability on the pages `View Active People`, `View Inactive people`, and `View All People`. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68112 · Other software · ChurchCRM · reported by GitHubCritical 9.6
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. The vulnerability enables attackers to extract sensitive member data, authentication credentials, and financial information from the church management system. Version 6.5.3 contains a patch for the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68110 · Other software · ChurchCRM · reported by GitHubCritical 9.9
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68109 · Other software · ChurchCRM · reported by GitHubCritical 9.1
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-67876 · Other software · ChurchCRM · reported by GitHubCritical 9.3
ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into group role names. The payload is saved in the database and executed whenever any user (including administrators) views a page that displays that role, such as GroupView.php or PersonView.php. This allows full session hijacking and account takeover. As of time of publication, no known patched versions are available.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*.CVE-2025-67791 · Other software · Drivelock · reported by MITRECritical 9.8
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in DriveLock tenant allows attackers to impersonate any DriveLock agent on the network against the DES (DriveLock Enterprise Service).
- Product
- Drivelock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6.CVE-2025-67793 · Other software · Drivelock · reported by MITRECritical 9.8
An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege can promote themselves or other DOC users to the Supervisor role through an API call. This privilege is included by default in the Administrator role. This issue mainly affects cloud multi-tenant deployments; on-prem single-tenant installations are typically not impacted because local admins usually already have Supervisor privileges.
- Product
- Drivelock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025This issue was addressed with improved URL validation.CVE-2025-43526 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content opened via a file URL may be able to use Web APIs that should be restricted.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 17, 2025A configuration issue was addressed with additional restrictions.CVE-2025-43428 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Photos in the Hidden Photos Album may be viewed without authentication.
- Product
- iOS and iPadOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 17, 2025An issue was discovered in 25.1.2 before 25.1.5.CVE-2025-67787 · Other software · Drivelock · reported by MITRECritical 9.6
An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network.
- Product
- Drivelock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5.CVE-2025-67781 · Other software · Drivelock · reported by MITRECritical 9.9
An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers.
- Product
- Drivelock
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.