Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: December 2025

218 records · 23 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 3

  • CVE-2025-13780
    35Monitor

    Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)

    HighCVSS 8.8Proof of conceptEPSS 0%

    pgadmin · pgadmin 4Dec 11, 2025

  • CVE-2025-55183
    40Plan

    An information leak vulnerability exists in specific configurations of React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.

    MediumCVSS 5.3Proof of conceptEPSS 64%

    vercel · next.jsDec 11, 2025

  • CVE-2025-55184
    50Plan

    A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.

    HighCVSS 7.5Proof of conceptEPSS 66%

    facebook · reactDec 11, 2025

  • CVE-2025-55816
    24Monitor

    HotelDruid v3.0.7 and before is vulnerable to Cross Site Scripting (XSS) in the /modifica_app.php file.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    digitaldruid · hoteldruidDec 11, 2025

  • CVE-2025-64702
    21Monitor

    quic-go HTTP/3 QPACK Header Expansion DoS

    MediumCVSS 5.3Proof of conceptEPSS 0%

    quic-go project · quic-goDec 11, 2025

  • CVE-2024-58286
    60This week

    dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path

    CriticalCVSS 9.3WeaponizedEPSS 1%

    vexorian · dizquetvDec 11, 2025

  • CVE-2024-58290
    37Monitor

    Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    elements · xhibiter nft marketplaceDec 11, 2025

  • CVE-2025-67780
    16Monitor

    SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gR

    MediumCVSS 4.2Proof of conceptEPSS 0%

    spacex · starlink dishDec 11, 2025

  • CVE-2025-67779
    36Monitor

    It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attac

    HighCVSS 7.5No exploitEPSS 19%

    facebook · reactDec 12, 2025

  • CVE-2025-67725
    30Monitor

    Tornado is Vulnerable to Quadratic DoS via Repeated Header Coalescing

    HighCVSS 7.5No exploitEPSS 0%

    tornadoweb · tornadoDec 12, 2025

  • CVE-2025-67727
    27Monitor

    Parse Server GitHub CI workflow vulnerable to RCE through Improper Privilege Management

    MediumCVSS 6.9Proof of conceptEPSS 0%

    parseplatform · parse-serverDec 12, 2025

  • CVE-2025-67730
    20Monitor

    Frappe authenticated users can execute XSS through form description fields

    MediumCVSS 5.1Proof of conceptEPSS 0%

    frappe · learningDec 12, 2025

  • CVE-2025-12841
    21Monitor

    Bookit < 2.5.1 – Unauthenticated Settings Update

    MediumCVSS 5.3Proof of conceptEPSS 0%

    unknown · bookitDec 12, 2025

  • CVE-2024-58299
    37Monitor

    PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Command

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    pcman · ftp serverDec 12, 2025

  • CVE-2025-14174
    82Now

    Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memo

    HighCVSS 8.8KEVWeaponizedEPSS 55%

    google · chromeDec 12, 2025

  • CVE-2025-14611
    74This week

    Gladinet CentreStack and TrioFox Hard Coded AES Keys

    HighCVSS 7.1KEVWeaponizedEPSS 53%

    gladinet · centrestackDec 12, 2025

  • CVE-2025-43510
    61This week

    A memory corruption issue was addressed with improved lock state checking.

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    apple · ipadosDec 12, 2025

  • CVE-2025-43520
    52Plan

    A memory corruption issue was addressed with improved memory handling.

    MediumCVSS 5.5KEVWeaponizedEPSS 0%

    apple · ipadosDec 12, 2025

  • CVE-2025-11693
    40Plan

    Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    recorp · export wordpress pages to static html & pdf — static site exportDec 13, 2025

  • CVE-2025-14440
    39Monitor

    JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    jayarsiech · jay login & registerDec 13, 2025

  • CVE-2025-14659
    30Monitor

    D-Link DIR-860LB1/DIR-868LB1 DHCP command injection

    HighCVSS 7.4Proof of conceptEPSS 3%

    dlink · dir-868l b1 firmwareDec 14, 2025

  • CVE-2025-67906
    36Monitor

    In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path.

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    misp-project · mispDec 15, 2025

  • CVE-2025-14704
    26Monitor

    Shiguangwu sgwbox N3 API eshell path traversal

    MediumCVSS 5.5No exploitEPSS 12%

    sgwbox · n3 firmwareDec 15, 2025

  • CVE-2025-14705
    40Plan

    Shiguangwu sgwbox N3 SHARESERVER Feature command injection

    HighCVSS 8.9No exploitEPSS 16%

    sgwbox · n3 firmwareDec 15, 2025

  • CVE-2025-14706
    41Plan

    Shiguangwu sgwbox N3 NETREBOOT http_eshell_server command injection

    HighCVSS 8.9No exploitEPSS 18%

    sgwbox · n3 firmwareDec 15, 2025

  • CVE-2025-14707
    41Plan

    Shiguangwu sgwbox N3 DOCKER Feature http_eshell_server command injection

    HighCVSS 8.9No exploitEPSS 18%

    sgwbox · n3 firmwareDec 15, 2025

  • CVE-2025-14156
    41Plan

    Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    ays-pro · fox lms – wordpress lms pluginDec 15, 2025

  • CVE-2025-65742
    32Monitor

    An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive in

    HighCVSS 8.2Proof of conceptEPSS 0%

    newgensoft · omnidocsDec 15, 2025

  • CVE-2025-64634
    21Monitor

    WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    theme-fusion · avadaDec 16, 2025

  • CVE-2025-68055
    34Monitor

    WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability

    HighCVSS 8.5Proof of conceptEPSS 0%

    themefic · hydra bookingDec 16, 2025

  • CVE-2025-13956
    21Monitor

    LearnPress – WordPress LMS Plugin <= 4.3.1 - Missing Authorization to Unauthenticated Orders Statistics Exposure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    thimpress · learnpress – wordpress lms plugin for create and sell online coursesDec 16, 2025

  • CVE-2025-65318
    36Monitor

    When using the attachment interaction functionality, Canary Mail 5.1.40 and below saves documents to a file system without a Mark-of-the-Web

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    canarymail · canary mailDec 16, 2025

  • CVE-2025-37164
    96Now

    A remote code execution issue exists in HPE OneView.

    CriticalCVSS 9.8KEVWeaponizedEPSS 90%

    hpe · oneviewDec 16, 2025

  • CVE-2025-68116
    21Monitor

    FileRise vulnerable to Cross-Site Scripting (XSS) in SVG File Handling

    MediumCVSS 5.4Proof of conceptEPSS 0%

    filerise · fileriseDec 16, 2025

  • CVE-2025-33210
    36Monitor

    NVIDIA Isaac Lab contains a deserialization vulnerability.

    CriticalCVSS 9.0Proof of conceptEPSS 0%

    nvidia · isaac labDec 16, 2025

  • CVE-2025-46295
    39Monitor

    Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input i

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    claris · filemaker serverDec 16, 2025

  • CVE-2025-65427
    26Monitor

    An issue was discovered in Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router on firmware version V1.0.0 does not implement rate limiting to

    MediumCVSS 6.5Proof of conceptEPSS 0%

    dbitnet · dbit n300 t1 pro firmwareDec 16, 2025

  • CVE-2025-68154
    36Monitor

    Command Injection in fsSize() on Windows

    HighCVSS 8.1No exploitEPSS 12%

    systeminformation · systeminformationDec 16, 2025

  • CVE-2025-14700
    41Plan

    Improper Neutralization of Special Elements Used in a Template Engine in Crafty Controller

    CriticalCVSS 9.9Proof of conceptEPSS 6%

    craftycontrol · crafty controllerDec 16, 2025

  • CVE-2025-14765
    36Monitor

    Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a cra

    HighCVSS 8.8Proof of conceptEPSS 2%

    google · chromeDec 16, 2025

  • CVE-2025-59374
    67This week

    "UNSUPPORTED WHEN ASSIGNED" Certain versions of the ASUS Live Update client were distributed with unauthorized modifications introduced thro

    CriticalCVSS 9.3KEVWeaponizedEPSS 1%

    asus · live updateDec 17, 2025

  • CVE-2025-20393
    80Now

    Cisco Secure Email Gateway and Cisco Secure Email and Web Manager Remote Command Execution Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 32%

    cisco · asyncosDec 17, 2025

  • CVE-2025-62521
    60This week

    ChurchCRM has unauthenticated RCE in its Install Wizard

    CriticalCVSS 9.8WeaponizedEPSS 4%

    churchcrm · churchcrmDec 17, 2025

  • CVE-2025-34441
    60This week

    AVideo < 20.1 User Information Disclosure via Public API

    MediumCVSS 6.9WeaponizedEPSS 0%

    wwbn · avideoDec 17, 2025

  • CVE-2025-34442
    60This week

    AVideo < 20.1 System Path Disclosure via Public API

    MediumCVSS 6.9WeaponizedEPSS 0%

    wwbn · avideoDec 17, 2025

  • CVE-2025-65855
    26Monitor

    The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentia

    MediumCVSS 6.6Proof of conceptEPSS 0%

    netun · helpflash iot firmwareDec 17, 2025

  • CVE-2025-67876
    37Monitor

    ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    churchcrm · churchcrmDec 17, 2025

  • CVE-2025-68400
    37Monitor

    ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    churchcrm · churchcrmDec 17, 2025

  • CVE-2025-43529
    73This week

    A use-after-free issue was addressed with improved memory management.

    HighCVSS 8.8KEVWeaponizedEPSS 25%

    apple · safariDec 17, 2025

  • CVE-2025-43541
    27Monitor

    A type confusion issue was addressed with improved state handling.

    MediumCVSS 4.3Proof of conceptEPSS 34%

    apple · safariDec 17, 2025

  • CVE-2025-67875
    34Monitor

    ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking

    HighCVSS 8.5Proof of conceptEPSS 0%

    churchcrm · churchcrmDec 17, 2025

  • CVE-2025-68109
    40Plan

    ChurchCRM vulnerable to RCE with database restore functionality

    HighCVSS 7.2WeaponizedEPSS 1%

    churchcrm · churchcrmDec 17, 2025

  • CVE-2025-68147
    32Monitor

    opensourcepos has a Cross-site Scripting vulnerability

    HighCVSS 8.1Proof of conceptEPSS 0%

    opensourcepos · open source point of saleDec 17, 2025

  • CVE-2025-68434
    35Monitor

    opensourcepos has Cross-Site Request Forgery vulnerability that leads to Unauthorized Administrator Creation

    HighCVSS 8.8Proof of conceptEPSS 0%

    opensourcepos · open source point of saleDec 17, 2025

  • CVE-2025-68461
    62This week

    Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG d

    MediumCVSS 6.1KEVWeaponizedEPSS 27%

    roundcube · webmailDec 18, 2025

  • CVE-2025-14364
    35Monitor

    Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation

    HighCVSS 8.8Proof of conceptEPSS 0%

    kraftplugins · demo importer plusDec 18, 2025

  • CVE-2025-40602
    57Plan

    A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC).

    MediumCVSS 6.6KEVWeaponizedEPSS 2%

    sonicwall · sma6200 firmwareDec 18, 2025

  • CVE-2025-14437
    31Monitor

    Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File

    HighCVSS 7.5Proof of conceptEPSS 1%

    wpmudev · hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdnDec 18, 2025

  • CVE-2025-68325
    0Monitor

    net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop

    Proof of conceptEPSS 0%

    linux · linuxDec 18, 2025

  • CVE-2025-14884
    32Monitor

    D-Link DIR-605 Firmware Update Service command injection

    HighCVSS 7.3No exploitEPSS 10%

    dlink · dir-605 firmwareDec 18, 2025

  • CVE-2025-56157
    39Monitor

    Default credentials in Dify thru 1.5.1.

    CriticalCVSS 9.8No exploitEPSS 0%

    langgenius · difyDec 18, 2025

  • CVE-2025-63387
    39Monitor

    Dify v1.9.1 is vulnerable to Insecure Permissions.

    HighCVSS 7.5Proof of conceptEPSS 29%

    langgenius · difyDec 18, 2025

  • CVE-2025-14733
    76This week

    WatchGuard Firebox iked Out of Bounds Write Vulnerability

    CriticalCVSS 9.3KEVWeaponizedEPSS 29%

    watchguard · firewareDec 18, 2025

  • CVE-2025-14847
    89Now

    Zlib compressed protocol header length confusion may allow memory read

    HighCVSS 8.7KEVWeaponizedEPSS 83%

    mongodb · mongodbDec 19, 2025

  • CVE-2025-34433
    60This week

    AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt

    CriticalCVSS 9.3WeaponizedEPSS 1%

    world wide broadcast network · avideoDec 19, 2025

  • CVE-2025-68613
    95Now

    n8n Vulnerable to Remote Code Execution via Expression Injection

    HighCVSS 8.8KEVWeaponizedEPSS 98%

    n8n · n8nDec 19, 2025

  • CVE-2023-25445
    21Monitor

    WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    happyfiles · happyfiles proDec 20, 2025

  • CVE-2025-14855
    28Monitor

    SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting

    HighCVSS 7.2Proof of conceptEPSS 0%

    brainstormforce · sureforms – contact form, payment form & other custom form builderDec 21, 2025

  • CVE-2025-14018
    29Monitor

    Unquoted Service Path in NetBT Consultancy's e-Fatura

    HighCVSS 7.3Proof of conceptEPSS 0%

    netbt consulting services inc. · e-faturaDec 22, 2025

  • CVE-2025-65270
    24Monitor

    Reflected cross-site scripting (XSS) vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute

    MediumCVSS 6.1Proof of conceptEPSS 0%

    clincapture · captivate electronic data captureDec 22, 2025

  • CVE-2025-68645
    80Now

    A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper

    HighCVSS 8.8KEVWeaponizedEPSS 48%

    synacor · zimbra collaboration suiteDec 22, 2025

  • CVE-2025-65790
    24Monitor

    A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    realtimelogic · fuguhubDec 22, 2025

  • CVE-2025-65817
    35Monitor

    LSC Smart Connect Indoor IP Camera 1.4.13 contains a RCE vulnerability in start_app.sh.

    HighCVSS 8.8Proof of conceptEPSS 0%

    lsc · smart connect indoor ip camera firmwareDec 22, 2025

  • CVE-2025-65856
    39Monitor

    Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06 allows unauthenti

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    xiongmaitech · xm530v200 x6-weq 8m firmwareDec 22, 2025

  • CVE-2025-65857
    30Monitor

    An issue was discovered in Xiongmai XM530 IP cameras on firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06.

    HighCVSS 7.5Proof of conceptEPSS 0%

    xiongmaitech · xm530v200 x6-weq 8m firmwareDec 22, 2025

  • CVE-2025-68615
    52Plan

    Net-SNMP snmptrapd crash

    CriticalCVSS 9.8No exploitEPSS 42%

    net-snmp · net-snmpDec 23, 2025

  • CVE-2025-14155
    21Monitor

    Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'

    MediumCVSS 5.3Proof of conceptEPSS 0%

    leap13 · premium addons for elementorDec 23, 2025

  • CVE-2025-59886
    35Monitor

    Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access t

    HighCVSS 8.8Proof of conceptEPSS 0%

    eaton · xcomfort ethernet communication interfaceDec 23, 2025

  • CVE-2025-65354
    39Monitor

    Improper input handling in /Grocery/search_products_itname.php inPuneethReddyHC event-management 1.0 permits SQL injection via the sitem_nam

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    puneethreddyhc · event managementDec 23, 2025

  • CVE-2024-57521
    40Plan

    SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in S

    CriticalCVSS 10.0Proof of conceptEPSS 0%

    ruoyi · ruoyiDec 23, 2025

  • CVE-2025-66209
    36Monitor

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup

    HighCVSS 8.8Proof of conceptEPSS 3%

    coollabs · coolifyDec 23, 2025

  • CVE-2025-66210
    38Monitor

    Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Import

    CriticalCVSS 9.4No exploitEPSS 2%

    coollabs · coolifyDec 23, 2025

  • CVE-2025-15048
    26Monitor

    Tenda WH450 HTTP Request CheckTools command injection

    MediumCVSS 5.5No exploitEPSS 12%

    tenda · wh450 firmwareDec 23, 2025

  • CVE-2025-68664
    45Plan

    LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs

    HighCVSS 8.2Proof of conceptEPSS 42%

    langchain · langchain coreDec 23, 2025

  • CVE-2025-13773
    40Plan

    Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Unauthenticated Remote Code Execution

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    tychesoftwares · print invoice & delivery notes for woocommerceDec 24, 2025

  • CVE-2025-13407
    27Monitor

    GravityForms < 2.9.23.1 - Unauthenticated Arbitrary File Upload

    MediumCVSS 6.8Proof of conceptEPSS 0%

    unknown · gravity formsDec 24, 2025

  • CVE-2025-68509
    18Monitor

    WordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability

    MediumCVSS 4.7Proof of conceptEPSS 0%

    jeff starr · user submitted postsDec 24, 2025

  • CVE-2025-68602
    18Monitor

    WordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability

    MediumCVSS 4.7Proof of conceptEPSS 0%

    scott paterson · accept donations with paypal & stripeDec 24, 2025

  • CVE-2019-25246
    34Monitor

    Beward N100 H.264 VGA IP Camera M2.1.6 Authenticated File Disclosure

    HighCVSS 7.1Proof of conceptEPSS 18%

    beward r&d co., ltd · n100 h.264 vga ip cameraDec 24, 2025

  • CVE-2025-68937
    38Monitor

    Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-

    CriticalCVSS 9.5Proof of conceptEPSS 0%

    forgejo · forgejoDec 26, 2025

  • CVE-2025-66947
    26Monitor

    SQL injection vulnerability in krishanmuraiji SMS v.1.0, within the /studentms/admin/edit-class-detail.php via the editid GET parameter.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    krishanmurariji · student management systemDec 26, 2025

  • CVE-2025-68668
    43Plan

    n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node

    CriticalCVSS 9.9No exploitEPSS 13%

    n8n · n8nDec 26, 2025

  • CVE-2025-54322
    44Plan

    Xspeeder SXZOS through 2025-12-26 allows root remote code execution via base64-encoded Python code in the chkid parameter to vLogin.py.

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    xspeeder · sxzosDec 27, 2025

  • CVE-2025-14177
    25Monitor

    Information Leak of Memory in getimagesize

    MediumCVSS 6.3Proof of conceptEPSS 0%

    php · phpDec 27, 2025

  • CVE-2025-15136
    32Monitor

    TRENDnet TEW-800MB Management wizardset do_setWizard_asp command injection

    HighCVSS 7.4No exploitEPSS 10%

    trendnet · tew-800mb firmwareDec 28, 2025

  • CVE-2025-15137
    32Monitor

    TRENDnet TEW-800MB NTPSyncWithHost.cgi sub_F934  command injection

    HighCVSS 7.4No exploitEPSS 11%

    trendnet · tew-800mb firmwareDec 28, 2025

  • CVE-2025-15139
    12Monitor

    TRENDnet TEW-822DRE formWsc sub_43ACF4  command injection

    LowCVSS 2.1No exploitEPSS 13%

    trendnet · tew-822dre firmwareDec 28, 2025

  • CVE-2025-52691
    96Now

    Upload Arbitrary Files

    CriticalCVSS 10.0KEVWeaponizedEPSS 85%

    smartertools · smartermailDec 29, 2025

  • CVE-2025-57460
    39Monitor

    File upload vulnerability in machsol machpanel 8.0.32 allows attacker to gain a webshell.

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    machsol · machpanelDec 29, 2025

  • CVE-2025-57462
    24Monitor

    Stored cross-site scripting (xss) in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF fi

    MediumCVSS 6.1Proof of conceptEPSS 0%

    machsol · machpanelDec 29, 2025