CVE-2025-15637

HighCVSS 8.1/10Last modified Oct 5, 2026

Description

Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published
Aug 20, 2026
Last modified
Oct 5, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-1563810.0Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt. Net::Dropbear versions before 0.14 includes versiCVE-2025-15649.8The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not proCVE-2025-156416.8Netskope was notified about a potential gap in its Netskope Client for Windows systems where a malicious insider with administrative privileCVE-2025-156426.8Netskope is notified about a potential gap in its Netskoped Client for Windows systems where a malicious insider with admin privileges can lCVE-2025-156437.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-bCVE-2025-156454.6Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validationCVE-2025-156469.8HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumboCVE-2025-156475.5CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are compCVE-2025-156495.5IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnCVE-2025-15657.5The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-CVE-2025-156536.8Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthoCVE-2025-156547.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS
CVE-2025-15637: High severity, CVSS 8.1 | Vulnix