NVD disclosure day
CVE-2025-25790
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability exists in FoxCMS's LocalTemplate.php component, allowing attackers to execute arbitrary code by uploading a crafted ZIP file. This could impact the integrity and availability of affected systems.
CVE-2025-25789
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A critical vulnerability in FoxCMS allows unauthenticated remote code execution via the sitemap controller. This could lead to a system compromise if exploited.
CVE-2025-25785
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
A Server-Side Request Forgery vulnerability in JizhiCMS software could allow attackers to scan internal networks. This critical flaw enables malicious actors to send crafted requests to reveal information about internal systems. Security-aware leaders should confirm if JizhiCMS is in use and externally exposed to asses
CVE-2025-25784
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability in Jizhicms allows attackers to execute code by uploading a crafted Zip file. This could compromise web servers and hosted content.
CVE-2025-25783
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An arbitrary file upload vulnerability exists in Emlog Pro's administrative plugin component, potentially allowing unauthenticated attackers to execute arbitrary code by uploading a crafted Zip file. If Emlog Pro is deployed publicly, this could lead to a system compromise. Organizations should determine if they use th