CVEs published in December 2025
5,238 vulnerabilities, 419 critical, 24 exploited.
- dedebizDedeBIZ catalog_add.php command injection5.1 Medium
- carmelo computer book storecode-projects Computer Book Store admin_delete.php sql injection6.9 Medium
- code-projects student file management systemcode-projects Student File Management System delete_student.php sql injection6.9 Medium
- unknown helloleads crm form shortcodeHelloLeads CRM Form Shortcode <= 1.0 - Unauthenticated Settings Reset5.3 Medium
- code-projects student file management systemcode-projects Student File Management System delete_user.php sql injection6.9 Medium
- wpvibes addon elements for elementor (formerly elementor addon elements)Addon Elements for Elementor <= 1.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- tomdever wpforo forumwpForo Forum <= 2.4.12 - Unauthenticated SQL Injection7.5 High
- eximExim before 4.99.1 allows remote heap corruption that will be further described on 2025-12-18.7.0 High
- angeljudesuarez student management systemitsourcecode Student Management System update_subject.php sql injection6.9 Medium
- code-projects simple attendance record systemcode-projects Simple Attendance Record System check.php sql injection6.9 Medium
- carmelo computer laboratory systemcode-projects Computer Laboratory System technical_staff_pic.php unrestricted upload5.1 Medium
- carmelo computer laboratory systemcode-projects Computer Laboratory System admin_pic.php unrestricted upload5.1 Medium
- code-projects student file management systemcode-projects Student File Management System save_student.php sql injection6.9 Medium
- angeljudesuarez student management systemitsourcecode Student Management System uprec.php sql injection6.9 Medium
- facebook-riares online pet shop management systemitsourcecode Online Pet Shop Management System update_cnp.php sql injection6.9 Medium
ox-rubyOSS-FuzzDynamic-stack-buffer-overflow in _ox_err_set_with_locationNo score- videolan vlc media playermmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of...4.8 Medium
- facebook-riares online pet shop management systemitsourcecode Online Pet Shop Management System addcnp.php sql injection6.9 Medium
- tenda ax9, ax9 firmware +1 moreTenda AX9 httpd image_check weak hash6.3 Medium
- code-projects student file management systemcode-projects Student File Management System update_student.php sql injection6.9 Medium
- code-projects student file management systemcode-projects Student File Management System save_user.php sql injection6.9 Medium
- code-projects student file management systemcode-projects Student File Management System update_user.php sql injection6.9 Medium
- code-projects student file management systemcode-projects Student File Management System login_query.php sql injection6.9 Medium
- code-projects student file management systemcode-projects Student File Management System login_query.php sql injection6.9 Medium
- jehovahs witnesses jw library appJehovahs Witnesses JW Library App org.jw.jwlibrary.mobile.activity.SiloContainer path traversal4.8 Medium
- offis dcmtkOFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption5.3 Medium
- tiny-rdm tiny rdmtiny-rdm Tiny RDM Pickle Decoding pickle_convert.go pickle.loads deserialization2.3 Low
- carmelo prison management systemcode-projects Prison Management System search1.php sql injection6.9 Medium
- carmelo prison management systemcode-projects Prison Management System search.php sql injection5.3 Medium
- angeljudesuarez student management systemitsourcecode Student Management System update_program.php sql injection6.9 Medium
utcpPyPICommand execution in python-utcp allows attackers to achieve remote code execution when fetching a remote Manual from a malicious endpoint7.5 High- facebook-riares online pet shop management systemitsourcecode Online Pet Shop Management System available.php sql injection6.9 Medium
- popupbuilder popup builder – create highly converting, mobile friendly marketing popups.Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- livemesh siteorigin widgetsLivemesh SiteOrigin Widgets <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hero Header and Pricing Table Widgets6.4 Medium
- themelooks enter addons – ultimate template builder for elementorEnter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgets6.4 Medium
- debuggersstudio marquee addons for elementor – essential motion widgets & templatesMarqueeAddons <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Marquee Widget6.4 Medium
- jetmonsters jetwidgets for elementorJetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets6.4 Medium
- kingaddons king addons for elementor – 80+ elementor widgets, 4 000+ elementor templates, woocommerce, mega menu, popup builderKing Addons for Elementor <= 51.1.39 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets6.4 Medium
- themefusecom brizy – page builderBrizy – Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function6.5 Medium
- growatt shinelan-x, shine lan-x firmware +1 moreUndocumented backup Account and No Password Configuration Capability9.4 Critical
- growatt shinelan-x, shine lan-x firmware +1 moreHardcoded FTP Credentials within the firmware9.4 Critical
- growatt shinelan-xAuthentication bypass on web interface9.3 Critical
- growatt shinelan-x, shine lan-x firmware +1 moreStored Cross-Site Scripting (XSS) vulnerability in Growatt ShineLan-X8.4 High
- growatt shinelan-x, shine lan-x firmware +1 moreSWD Interface Open on Growatt ShineLan-X8.6 High
- growatt shinelan-x, shine lan-x firmware +1 moreStored cross site scripting (XSS) vulnerability in Growatt ShineLan-X8.5 High
- growatt shinelan-xMissing encryption on Local Configuration Interface or Cloud Endpoint Communication - Growatt MIC3300TL-X and ShineLan-X9.4 Critical
- shamsbd71 all-in-one addons for elementor – widgetkitAll-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets6.4 Medium
- wssoffice21 ymc filterFilter & Grids <= 3.2.0 - Unauthenticated SQL Injection5.9 Medium
- templateinvaders ti woocommerce wishlistTI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection5.3 Medium
- rupok98 url shortener plugin for wordpressURL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection9.8 Critical
- Show moreLoading…