CVE-2025-68398

CriticalCVSS 9.1/10Last modified Sep 30, 2026

Description

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override some of its behavior. Version 5.15.1 fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-20CWE-22CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2025
Last modified
Sep 30, 2026
NVD status
Modified

Related CVEs from 2025

CVE-2025-683995.4ChurchCRM is an open-source church management system. In versions prior to 6.5.4, there is a Stored Cross-Site Scripting (XSS) vulnerabilityCVE-2025-68409.8A vulnerability, which was classified as critical, was found in code-projects Product Inventory System 1.0. This affects an unknown part of CVE-2025-684008.8ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmaCVE-2025-684014.8ChurchCRM is an open-source church management system. Prior to version 6.0.0, the application stores user-supplied HTML/JS without sufficienCVE-2025-684028.2FreshRSS is a free, self-hostable RSS aggregator. From 57e1a37 - 00f2f04, the lengths of the nonce was changed from 40 chars to 64. passwordCVE-2025-684034.6An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an admiCVE-2025-684047.5A time-of-check time-of-use (toctou) race condition vulnerability has been reported to affect QuRouter. If exploited, the vulnerability coulCVE-2025-684066.5A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2025-68417.2A vulnerability has been found in code-projects Product Inventory System 1.0 and classified as critical. This vulnerability affects unknown CVE-2025-68427.2A vulnerability was found in code-projects Product Inventory System 1.0 and classified as critical. This issue affects some unknown processiCVE-2025-684207.5Comarch ERP Optima client connects to a database using a high privileged account regardless of an application account to which a user logs iCVE-2025-684218.7Comarch ERP Optima client makes use of a hard-coded password for a database user. These credentials cannot be changed. It is possible for a
CVE-2025-68398: Critical severity, CVSS 9.1 | Vulnix