NVD disclosure day

Published threat advisories for December 1, 2025

CVE-2025-51683

mJobtime Blind SQL Injection Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A blind SQL injection vulnerability in mJobtime software allows unauthenticated attackers to execute arbitrary SQL statements via a crafted request to an update profile endpoint. This could potentially impact data integrity and availability if the vulnerable endpoint is exposed. Confirmation of software usage and expos

NVD published: December 1, 2025

CVE advisoryCRITICAL

CVE-2025-51682

mJobtime Client-Side Authorization Bypass Allows Administrative Feature Access

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability exists in mJobtime due to improper handling of client-side authorization, allowing an attacker to modify client-side code to access administrative features and directly call functions. This could lead to unauthorized access and modification of system data if the affected system is reachable.

NVD published: December 1, 2025