CVE-2025-3703

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wipeoutmedia CSS & JavaScript Toolbox css-javascript-toolbox allows PHP Local File Inclusion.This issue affects CSS & JavaScript Toolbox: from n/a through < 12.0.3.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-98

Affected software

No affected versions have been published.

Timeline

Published: Aug 14, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-37045.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DBAR Productions Volunteer Sign Up She CVE-2025-37056.8A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used CVE-2025-37066.1The eHRMS from 104 Corporation has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbi CVE-2025-37076.5The eHDR CTMS from Sunnet has a SQL Injection vulnerability, allowing remote attackers with regular privileges to inject arbitrary SQL comma CVE-2025-37089.8Le-show medical practice management system from Le-yan has a SQL Injection vulnerability, allowing unauthenticated remote attackers to injec CVE-2025-370879.8A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary fil CVE-2025-370886.8A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, CVE-2025-370899.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-37099.8Agentflow from Flowring Technology has an Account Lockout Bypass vulnerability, allowing unauthenticated remote attackers to exploit this vu CVE-2025-370909.8A server-side request forgery vulnerability exists in HPE StoreOnce Software.CVE-2025-370919.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.CVE-2025-370929.8A command injection remote code execution vulnerability exists in HPE StoreOnce Software.