CVE-2025-67135

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-294

Affected software

No affected versions have been published.

Timeline

Published
Feb 11, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-67147.5MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongCVE-2025-671469.4Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, CVE-2025-671479.8Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parametCVE-2025-67159.8The LatePoint WordPress plugin before 5.1.94 is vulnerable to Local File Inclusion via the layout parameter. This makes it possible for attCVE-2025-671587.5An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitivCVE-2025-671597.5Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.CVE-2025-67166.4The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share BuCVE-2025-671607.5An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal.CVE-2025-671636.1A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML CVE-2025-671649.9An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arCVE-2025-671659.8An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.CVE-2025-671685.3RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.
CVE-2025-67135: Critical severity, CVSS 9.8 | Vulnix