CVE-2025-64725

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains a patch. As a workaround, avoid leaving one's Weblate sessions with an invitation opened unattended.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-286

Affected software

No affected versions have been published.

Timeline

Published
Dec 15, 2025
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-647267.3Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous CVE-2025-647298.2The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project fileCVE-2025-64736.1A vulnerability, which was classified as problematic, was found in code-projects School Fees Payment System 1.0. This affects an unknown parCVE-2025-647306.1Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executeCVE-2025-647337.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-647342.4Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to peCVE-2025-647357.1An out-of-bounds read vulnerability exists in the EMF functionality of Canva Affinity. By using a specially crafted EMF file, an attacker coCVE-2025-647367.1An out-of-bounds read vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.2 and Master Branch (5462afbCVE-2025-647385.5External control of file name or path in Zoom Workplace for macOS before version 6.5.10 may allow an authenticated user to conduct a disclosCVE-2025-647397.5External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via nCVE-2025-64749.8A vulnerability has been found in code-projects Inventory Management System 1.0 and classified as critical. This vulnerability affects unknoCVE-2025-647407.8Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user
CVE-2025-64725: Critical severity, CVSS 9.8 | Vulnix