Latest CVE Feed

Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.

Latest Critical Actively Exploited Remotely Exploitable

9.8

CRITICAL

CVE-2025-65235

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function....

Affected Products :
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Injection
7.7

HIGH

CVE-2025-12758

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\uFE0F, \uFE0E) appearing in a se...

Affected Products : validator
Published: Nov. 27, 2025

Modified: Dec. 03, 2025

Vuln Type: Denial of Service
7.1

HIGH

CVE-2025-11461

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1....

Affected Products : frappe_crm
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Injection
7.2

HIGH

CVE-2025-64050

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is e...

Affected Products : redaxo
Published: Nov. 25, 2025

Modified: Dec. 03, 2025

Vuln Type: Injection
4.8

MEDIUM

CVE-2025-64049

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits a...

Affected Products : redaxo
Published: Nov. 25, 2025

Modified: Dec. 03, 2025

Vuln Type: Cross-Site Scripting
9.0

CRITICAL

CVE-2025-66224

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail configuration and delivery workflow that allows user-controlled values to flow directly into th...

Affected Products : orangehrm
Published: Nov. 29, 2025

Modified: Dec. 03, 2025

Vuln Type: Injection
8.9

HIGH

CVE-2025-66263

Unauthenticated Arbitrary File Read via Null Byte Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Null byte injection in download_s...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Path Traversal
9.8

CRITICAL

CVE-2025-66262

Arbitrary File Overwrite via Tar Extraction Path Traversal in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Tar extraction with -C / allow arb...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Path Traversal
9.9

CRITICAL

CVE-2025-66261

Unauthenticated OS Command Injection (restore_settings.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform URL-decoded name parameter passed...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Injection
7.2

HIGH

CVE-2025-66260

PostgreSQL SQL Injection (status_sql.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform SQL injection via sw1 and sw2 parameters in status_...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Injection
8.8

HIGH

CVE-2025-66225

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username submitted in the final reset request matches the account for which the reset process was originall...

Affected Products : orangehrm
Published: Nov. 29, 2025

Modified: Dec. 03, 2025

Vuln Type: Authentication
9.8

CRITICAL

CVE-2025-66259

Authenticated Root Remote Code Execution via improrer user input filtering in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform in main_ok.php use...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Injection
7.1

HIGH

CVE-2025-66258

Stored Cross-Site Scripting via XML Injection in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Stored XSS via crafted filenames injected into ...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Cross-Site Scripting
9.2

CRITICAL

CVE-2025-66257

Unauthenticated Arbitrary File Deletion (patch_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletepatch parameter allows...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Path Traversal
9.9

CRITICAL

CVE-2025-66255

Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Missing signature validation all...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Authentication
9.1

CRITICAL

CVE-2025-66254

Unauthenticated Arbitrary File Deletion (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deleteupgrade parameter al...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Path Traversal
9.9

CRITICAL

CVE-2025-66253

Unauthenticated OS Command Injection (start_upgrade.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform User input passed directly to exec()...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Injection
8.8

HIGH

CVE-2025-66289

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user is disabled or when a password change occurs, allowing active session cookies to remain valid i...

Affected Products : orangehrm
Published: Nov. 29, 2025

Modified: Dec. 03, 2025

Vuln Type: Authentication
8.4

HIGH

CVE-2025-66252

Infinite Loop Denial of Service via Failed File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform Infinite loop when unlink() fails in...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Denial of Service
9.1

CRITICAL

CVE-2025-66251

Unauthenticated Path Traversal with Arbitrary File Deletion in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transmitter versions 30, 50, 100, 300, 500, 1000, 2000, 3000, 3500, 6000, 7000 allows an attacker to perform The deletehidden parameter allows...

Affected Products : mozart_next_100_firmware mozart_next_100 mozart_next_1000_firmware mozart_next_1000 mozart_next_2000_firmware mozart_next_2000 mozart_next_30_firmware mozart_next_30 mozart_next_300_firmware mozart_next_300 +34 more products
Published: Nov. 26, 2025

Modified: Dec. 03, 2025

Vuln Type: Path Traversal

Showing 20 of 4030 Results

Browse by Apps

Latest CVE Feed

9.8

7.7

7.1

7.2

4.8

9.0

8.9

9.8

9.9

7.2

8.8

9.8

7.1

9.2

9.9

9.1

9.9

8.8

8.4

9.1

CVEFeed.io UI Customizer

Layout

Vertical

Horizontal

Two Column

Color Scheme

Light

Dark

Layout Width

Fluid

Boxed

Layout Position

Topbar Color

Light

Dark

Sidebar Size

Default

Compact

Small (Icon View)

Small Hover View

Sidebar View

Default

Detached

Sidebar Color

Light

Dark

Gradient

Preloader

Enable

Disable