Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
17,387 results · page 99 of 348
Jan 5, 2026In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automaCVE-2025-68757 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence automatically in 10 seconds is now released with timer_delete_sync() from fence->ops.release() called on last dma_fence_put(). In some scenarios, it can run in IRQ context, which is not safe unless TIMER_IRQSAFE is used. One potentially risky scenario was demonstrated in Intel DRM CI trybot, BAT run on machine bat-adlp-6, while working on new IGT subtests syncobj_timeline@stress-* as user space replacements of some problematic test cases of a dma-fence-chain selftest [1]. [117.004338] ================================ [117.004340] WARNING: inconsistent lock state [117.004342] 6.17.0-rc7-CI_DRM_17270-g7644974e648c+ #1 Tainted: G S U [117.004346] -------------------------------- [117.004347] inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage. [117.004349] swapper/0/0 [HC1[1]:SC1[1]:HE0:SE0] takes: [117.004352] ffff888138f86aa8 ((&fence->timer)){?.-.}-{0:0}, at: __timer_delete_sync+0x4b/0x190 [117.004361] {HARDIRQ-ON-W} state was registered at: [117.004363] lock_acquire+0xc4/0x2e0 [117.004366] call_timer_fn+0x80/0x2a0 [117.0
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Jan 2, 2026A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9.CVE-2025-64119 · Other software · Nuvation Energy · reported by ot-cert@dragos.comCritical 9.3
A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9.
- Product
- Battery Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Plane is an an open-source project management tool.CVE-2025-69284 · Other software · makeplane · reported by GitHubMedium 4.3
Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug/members/` is accessible by guest and able to list of users on a specific workspace that they joined. Since the `display_name` in the response is actually the handler of the email, a malicious guest can still identify admin users' email addresses. Version 1.2.0 fixes this issue.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 31, 2025Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/run_commands.sh.CVE-2015-10145 · Other software · Gargoyle · reported by VulnCheckHigh 8.7
Gargoyle router management utility versions 1.5.x contain an authenticated OS command execution vulnerability in /utility/run_commands.sh. The application fails to properly restrict or validate input supplied via the 'commands' parameter, allowing an authenticated attacker to execute arbitrary shell commands on the underlying system. Successful exploitation may result in full compromise of the device, including unauthorized access to system files and execution of attacker-controlled commands.
- Product
- Gargoyle Router Management Utility
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.xlab.qianxin.compacketstorm.news
Dec 31, 2025KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration.CVE-2021-47740 · Other software · KZ Broadband Technologies, Ltd. · reported by VulnCheckMedium 6.9
KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. Attackers can exploit the weak session handling to maintain unauthorized access and potentially compromise device authentication mechanisms.
- Product
- JT3500V
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkzbtech.comexchange.xforce.ibmcloud.com
Dec 30, 2025ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2025-69204 · Other software · ImageMagick · reported by GitHubMedium 5.3
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store number_attributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack. Version 7.1.2-12 fixes the issue.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2025-68950 · Other software · ImageMagick · reported by GitHubMedium 4
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular references between two MVGs, leading to a stack overflow. This is a DoS vulnerability, and any situation that allows reading the mvg file will be affected. Version 7.1.2-12 fixes the issue.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2025-68618 · Other software · ImageMagick · reported by GitHubMedium 5.3
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2025HR Management Lite: Missing AuthorizationCVE-2025-69022 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.
- Product
- HR Management Lite
- Affected
- up to 3.6
- What to do
- Affects up to 3.6. Update HR Management Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 29, 2025Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery)CVE-2023-32238 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Vulnerability in CodexThemes TheGem (Elementor), CodexThemes TheGem (WPBakery).This issue affects TheGem (Elementor): from n/a before 5.8.1.1; TheGem (WPBakery): from n/a before 5.8.1.1.
- Fixed in
- 5.8.1.1
- What to do
- Update the plugin to 5.8.1.1 or newer.
Dec 29, 2025Frappe CRM is an open-source customer relationship management tool.CVE-2025-68928 · Other software · frappe · reported by GitHubMedium 5.4
Frappe CRM is an open-source customer relationship management tool. Prior to version 1.56.2, authenticated users could set crafted URLs in a website field, which were not sanitized, causing cross-site scripting. Version 1.56.2 fixes the issue. No known workarounds are available.
- Product
- crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 28, 2025A security vulnerability has been detected in Advaya Softech GEMS ERP Portal up to 2.1.CVE-2025-15170 · Other software · Advaya Softech · reported by VulDBLow 2.1
A security vulnerability has been detected in Advaya Softech GEMS ERP Portal up to 2.1. This affects an unknown part of the file /home.jsp?isError=true of the component Error Message Handler. The manipulation of the argument Message leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- GEMS ERP Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025SiYuan is self-hosted, open source personal knowledge management software.CVE-2025-68948 · Other software · siyuan-note · reported by GitHubMedium 6.9
SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode is stored within the session cookie, an attacker who intercepts or obtains a user's encrypted session cookie (e.g., via session hijacking) can locally decrypt it using the public key. Once decrypted, the attacker can retrieve the AccessAuthCode in plain text and use it to authenticate or take over the session.
- Product
- siyuan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2025The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) proCVE-2025-67013 · Other software · Etlsystems · reported by MITREMedium 6.5
The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.
- Product
- D0116s1ula-22454 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.cometlsystems.com
Dec 26, 2025SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter.CVE-2025-66947 · Other software · Krishanmurariji · reported by MITREMedium 6.5
SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter. An attacker can trigger controlled delays using SQL SLEEP() to infer database contents. Successful exploitation may lead to full database compromise, especially within an administrative module.
- Product
- Student Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2025Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessibleCVE-2025-68919 · Other software · Fujitsu / Fsas Technologies · reported by MITREMedium 5.6
Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessible by a principal/authority other than ETERNUS SF Admin, allows an attacker to potentially affect system confidentiality, integrity, and availability.
- Product
- ETERNUS SF ACM/SC/Express
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.ts.fujitsu.com
Dec 24, 2025Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'urlCVE-2019-25251 · Other software · Teradek, LLC · reported by VulnCheckMedium 6.9
Teradek VidiU Pro 3.0.3 contains a server-side request forgery vulnerability in the management interface that allows attackers to manipulate GET parameters 'url' and 'xml_url'. Attackers can exploit this flaw to bypass firewalls, initiate network enumeration, and potentially trigger external HTTP requests to arbitrary destinations.
- Product
- VidiU Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comteradek.com
Dec 23, 2025Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_name POST parameter.CVE-2025-65354 · Other software · Puneethreddyhc · reported by MITRECritical 9.8
Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_name POST parameter. Crafted payloads can alter query logic and disclose database contents. Exploitation may result in sensitive data disclosure and backend compromise.
- Product
- Event Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 23, 2025TheGem Theme Elements (for Elementor): Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-68560 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.
- Product
- TheGem Theme Elements (for Elementor)
- Affected
- up to 5.10.5.1
- What to do
- Affects up to 5.10.5.1. Update TheGem Theme Elements (for Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 23, 2025TheGem Theme Elements (for Elementor): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-68559 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor.This issue affects TheGem Theme Elements (for Elementor): from n/a through <= 5.10.5.1.
- Product
- TheGem Theme Elements (for Elementor)
- Affected
- up to 5.10.5.1
- What to do
- Affects up to 5.10.5.1. Update TheGem Theme Elements (for Elementor) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 22, 2025myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject maliciCVE-2023-53977 · Other software · Mybb · reported by VulnCheckMedium 5.1
myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the forum management system that allows authenticated administrators to inject malicious scripts when creating new forums. Attackers can exploit this vulnerability by inserting script payloads in the forum title field when adding new forums through the 'Forums and Posts' > 'Forum Management' interface, causing arbitrary JavaScript to execute when the forum listing is viewed.
- Product
- myBB forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmybb.comexploit-db.com
Dec 22, 2025myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administrators to inject malCVE-2023-53976 · Other software · Mybb · reported by VulnCheckMedium 5.1
myBB Forums 1.8.26 contains a stored cross-site scripting vulnerability in the template management system that allows authenticated administrators to inject malicious scripts when creating new templates. Attackers can exploit this vulnerability by inserting script payloads in the template title field when adding new templates through the 'Templates and Style' > 'Templates' > 'Manage Templates' > 'Global Templates' interface, causing arbitrary JavaScript to execute when the template is viewed.
- Product
- myBB forums
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmybb.comexploit-db.com
Dec 22, 2025Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-boundCVE-2023-53970 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckHigh 8.7
Screen SFT DAB 600/C Firmware 1.9.3 contains a weak session management vulnerability that allows attackers to bypass authentication controls by reusing IP-bound session identifiers. Attackers can exploit the vulnerable deviceManagement API endpoint to reset device configurations by sending crafted POST requests with manipulated session parameters.
- Product
- Screen SFT DAB 600/C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 22, 2025Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP addressCVE-2023-53969 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckCritical 9.3
Screen SFT DAB 600/C firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to change user passwords without proper authentication.
- Product
- Screen SFT DAB 600/C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 22, 2025Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP addressCVE-2023-53968 · Other software · DB Elettronica Telecomunicazioni SpA · reported by VulnCheckCritical 9.3
Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authentication controls by exploiting IP address session binding. Attackers can reuse the same IP address and issue unauthorized requests to the userManager API to remove user accounts without proper authentication.
- Product
- Screen SFT DAB 600/C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddbbroadcast.comdbbroadcast.com
Dec 19, 2025Galette is a membership management web application for non profit organizations.CVE-2025-58053 · Other software · galette · reported by GitHubMedium 4.9
Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating any existing account with a self forged POST request, one can gain higher privileges. Version 1.2.0 fixes the issue.
- Product
- galette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Galette is a membership management web application for non profit organizations.CVE-2025-58052 · Other software · galette · reported by GitHubLow 2.1
Galette is a membership management web application for non profit organizations. Starting in version 0.9.6 and prior to version 1.2.0, attackers with group manager role can bypass intended restrictions allowing unauthorized access and changes despite role-based controls. Since it requires privileged access initially, exploitation is restricted to malicious insiders or compromised group managers accounts. Version 1.2.0 fixes the issue.
- Product
- galette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Galette is a membership management web application for non profit organizations.CVE-2025-53922 · Other software · galette · reported by GitHubLow 1.3
Galette is a membership management web application for non profit organizations. Starting in version 1.1.4 and prior to version 1.2.0, a user who is logged in as group manager may bypass intended restrictions on Contributions and Transactions. Version 1.2.0 fixes the issue.
- Product
- galette
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program: Missing AuthorizationCVE-2025-12361 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.9.7.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive information including user IDs, display names, and email addresses of all users on the site via the get_bank_accounts AJAX action. Passwords are not exposed.
- Product
- myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program
- Affected
- up to 2.9.7.1
- What to do
- Affects up to 2.9.7.1. Update myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0.CVE-2025-14900 · Other software · CodeAstro · reported by VulDBLow 2
A security vulnerability has been detected in CodeAstro Real Estate Management System 1.0. Affected is an unknown function of the file /admin/userdelete.php of the component Administrator Endpoint. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Dec 18, 2025A weakness has been identified in CodeAstro Real Estate Management System 1.0.CVE-2025-14899 · Other software · CodeAstro · reported by VulDBLow 2
A weakness has been identified in CodeAstro Real Estate Management System 1.0. This impacts an unknown function of the file /admin/stateadd.php of the component Administrator Endpoint. This manipulation causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Dec 18, 2025A security flaw has been discovered in CodeAstro Real Estate Management System 1.0.CVE-2025-14898 · Other software · CodeAstro · reported by VulDBLow 2
A security flaw has been discovered in CodeAstro Real Estate Management System 1.0. This affects an unknown function of the file /admin/userbuilderdelete.php of the component Administrator Endpoint. The manipulation results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Dec 18, 2025A vulnerability was identified in CodeAstro Real Estate Management System 1.0.CVE-2025-14897 · Other software · CodeAstro · reported by VulDBLow 2
A vulnerability was identified in CodeAstro Real Estate Management System 1.0. The impacted element is an unknown function of the file /admin/useragentdelete.php of the component Administrator Endpoint. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
- Product
- Real Estate Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Dec 18, 2025A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web scriCVE-2025-63949 · Other software · Yohanawi · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web script via the 'error' parameter in pages/room.php.
- Product
- Hotel Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025ImageMagick is free and open-source software used for editing and manipulating digital images.CVE-2025-68469 · Other software · ImageMagick · reported by GitHubLow 2
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.1-14, ImageMagick crashes when processing a crafted TIFF file. Version 7.1.1-14 fixes the issue.
- Product
- ImageMagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Tina is a headless content management system.CVE-2025-68278 · Other software · tinacms · reported by GitHubHigh 7.3
Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers that can control the content of the processed markdown files, e.g., blog posts, to execute arbitrary code. tinacms version 3.1.1, @tinacms/cli version 2.0.4, and @tinacms/graphql version 2.0.3 contain a fix for the issue.
- Product
- tinacms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Advance Seat Reservation Management for WooCommerce: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2025-58951 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartcms Advance Seat Reservation Management for WooCommerce scw-seat-reservation allows SQL Injection.This issue affects Advance Seat Reservation Management for WooCommerce: from n/a through <= 3.1.
- Product
- Advance Seat Reservation Management for WooCommerce
- Affected
- up to 3.1
- What to do
- Affects up to 3.1. Update Advance Seat Reservation Management for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68401 · Other software · ChurchCRM · reported by GitHubMedium 6.2
ChurchCRM is an open-source church management system. Prior to version 6.0.0, the application stores user-supplied HTML/JS without sufficient sanitization/encoding. When other users later view this content, attacker-controlled JavaScript executes in their browser (stored XSS). In affected contexts the script can access web origin data and perform privileged actions as the victim. Where session cookies are not marked HttpOnly, the script can read document.cookie, enabling session theft and account takeover. Version 6.0.0 patches the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68400 · Other software · ChurchCRM · reported by GitHubCritical 9.3
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed and reachable directly via URL. This is a classic case of *dead but reachable code*. Any authenticated user - including one with zero assigned permissions - can exploit SQL injection through the `familyId` parameter. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68399 · Other software · ChurchCRM · reported by GitHubLow 2
ChurchCRM is an open-source church management system. In versions prior to 6.5.4, there is a Stored Cross-Site Scripting (XSS) vulnerability within the GroupEditor.php page of the application. When a user attempts to create a group role, they can execute malicious JavaScript. However, for this to work, the user must have permission to view and modify groups in the application. Version 6.5.4 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68275 · Other software · ChurchCRM · reported by GitHubCritical 9.2
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnerability on the pages `View Active People`, `View Inactive people`, and `View All People`. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs.CVE-2025-68129 · WordPress plugins & themes · reported by GitHubMedium 6.8
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.
- What to do
- Update the plugin to the newest version.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68112 · Other software · ChurchCRM · reported by GitHubCritical 9.6
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. The vulnerability enables attackers to extract sensitive member data, authentication credentials, and financial information from the church management system. Version 6.5.3 contains a patch for the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68111 · Other software · ChurchCRM · reported by GitHubHigh 7.2
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability exists in the `eGive.php` file within the "ReImport" functionality. An authenticated user with finance privileges can execute arbitrary SQL queries by manipulating the `MissingEgive_FamID_...` POST parameter. This can lead to unauthorized data access, modification, or deletion within the database. Version 6.5.3 has a patch for the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68110 · Other software · ChurchCRM · reported by GitHubCritical 9.9
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-68109 · Other software · ChurchCRM · reported by GitHubCritical 9.1
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-67877 · Other software · ChurchCRM · reported by GitHubHigh 7.4
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the `src/CartToFamily.php` file, specifically in how the `PersonAddress` POST parameter is handled. Unlike other parameters in the same file which are correctly cast to integers using the `InputUtils` class, the `PersonAddress` parameter is missing the type definition. This allows an attacker to inject arbitrary SQL commands directly into the query. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-67876 · Other software · ChurchCRM · reported by GitHubCritical 9.3
ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into group role names. The payload is saved in the database and executed whenever any user (including administrators) views a page that displays that role, such as GroupView.php or PersonView.php. This allows full session hijacking and account takeover. As of time of publication, no known patched versions are available.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025ChurchCRM is an open-source church management system.CVE-2025-67875 · Other software · ChurchCRM · reported by GitHubHigh 8.5
ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile. The payload executes when the administrator views their own profile page, allowing the attacker to hijack the administrator's session, perform administrative actions, and achieve a full account takeover. This vulnerability is a combination of two separate flaws: an Insecure Direct Object Reference (IDOR) that allows any user to view any other user's profile, and a Broken Access Control vulnerability that allows a user with general edit permissions to modify any other user's record properties. Version 6.5.3 fixes the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 17, 2025Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of maliciouCVE-2025-59849 · Other software · HCL Software · reported by psirt@hcl.comMedium 4.7
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.
- Product
- BigFix Remote Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.hcl-software.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.