CVE-2025-32925

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points rewardsystem allows PHP Local File Inclusion.This issue affects SUMO Reward Points: from n/a through <= 30.7.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published
May 19, 2025
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-329269.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThemeGoods Grand Restaurant grandrestaurant CVE-2025-329279.8Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakerCVE-2025-329289.8Deserialization of Untrusted Data vulnerability in ThemeGoods Altair altair allows Object Injection.This issue affects Altair: from n/a throCVE-2025-329297.5Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pCVE-2025-329319.1DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands vCVE-2025-329325.4An Improper neutralization of input during web page generation ('cross-site scripting') vulnerability [CWE-79] in FortiSOAR version 7.6.1 anCVE-2025-32947.2The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and incCVE-2025-329427.2SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.CVE-2025-329434.3The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traveCVE-2025-329446.5The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner.  If user import is CVE-2025-329454.3The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code seCVE-2025-329465.3This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code se