CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
crypto-hashcrates.iocrypto-hash crate is unmaintainedNo scoreservo-fontconfigcrates.ioservo-fontconfig crate is unmaintainedNo score- multi-purpose inventory management system inventory management systemStored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management System5.1 Medium
- jinher oaJinher OA XML Type xml external entity reference6.9 Medium
- webwork php scriptReflected Cross-Site Scripting (XSS) in WebWork5.1 Medium
- jinher oaJinher OA XML Type xml external entity reference6.9 Medium
- itcube software crmPath Traversal in ITCube CRM9.2 Critical
- apostrophecms sanitize-html'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). The function ...6.1 Medium
- debian linux, linux kernel, siemens simatic cn 4100 +2 moresmb: client: fix race with concurrent opens in rename(2)7.8 High
- apostrophecms sanitize-htmlsanitize-html is vulnerable to XSS through incomprehensive sanitization6.1 Medium
- jinher oaJinher OA GetTreeDate.aspx sql injection6.9 Medium
- apache jackrabbit, apache software foundation jackrabbit core, jackrabbit jcr commons +2 moreApache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory6.5 Medium
- germanpearls time tracker, rems personal time tracker +1 moreSourceCodester Time Tracker index.html cross site scripting5.1 Medium
- wago coupler 0750-0362, coupler 0750-0362/0000-0001, coupler 0750-0362/0040-0000 +7 more +9 moreImproper Permission Handling Enables Unauthorized Access to Firmware and Certificates7.5 High
- bender cc612, cc613, icc13xx +2 more +4 moreCleartext Transmission of Sensitive Data via Insecure HTTP Web Interface7.4 High
- bender cc612, cc613, icc13xx +1 more +3 moreCredential Disclosure via Insecure Storage on Charge Controller8.8 High
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software profit_report.php sql injection5.1 Medium
- fuyang lipengjun platformfuyang_lipengjun platform AdPositionController queryAll improper authorization5.3 Medium
- metaphorcreations dittyDitty < 3.1.58 - Unauthenticated SSRF8.6 High
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software manage_website.php unrestricted upload5.3 Medium
- eladminelunez eladmin SysLogController 1 queryErrorLogDetail improper authorization5.3 Medium
- ricoh company, ltd. streamline nxRICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If...2.3 Low
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software profile.php unrestricted upload5.3 Medium
- campcodes online polling systemSourceCodester Online Polling System manage-admins.php sql injection6.9 Medium
- sourcecodester pet management system, mayurik pet grooming management software +1 moreSourceCodester Pet Management System profile.php unrestricted upload5.1 Medium
- running-elephant datartrunning-elephant Datart API AESUtil.java getTokensecret hard-coded key2.3 Low
- phpgurukul small crmPHPGurukul Small CRM get-quote.php sql injection6.9 Medium
- campcodes online polling systemSourceCodester Online Polling System candidates.php sql injection6.9 Medium
- campcodes online polling systemSourceCodester Online Polling System registeracc.php sql injection6.9 Medium
- campcodes online polling systemSourceCodester Online Polling System manage-profile.php sql injection6.9 Medium
- campcodes online polling systemSourceCodester Online Polling System manage-profile.php cross site scripting5.1 Medium
- portabilis i-educarPortabilis i-Educar tipos cross site scripting5.1 Medium
openafsDebianopenafs - regression updateNo score- microsoft windowsThe Microsoft vulnerable driver block list is implemented as Windows Defender Application Control...7.4 High
- codecept codeceptjsCodeceptJS's incomprehensive sanitation can lead to Command Injection9.8 Critical
- ruisitech ruisibirsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.9.8 Critical
- foxcmsFoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app...7.3 High
- avigilon access control managerA CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows...9.8 Critical
- avigilon access control managerA Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute...9.8 Critical
- n8nN8N's Chat Trigger component is vulnerable to XSS8.8 High
- mezereon smart search and filterA cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify App 1.0 allows a...8.1 High
- weiphpWeiPHP v5.0 and before is vulnerable to SQL Injection via the SucaiController.class.php file and...8.4 High
- No product listedAn Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4...8.8 High
- open5gsAssertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the...7.5 High
- scholl weblication cmsScholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross...9.8 Critical
- No product listedOPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other...9.8 Critical
- geeeeeeeek dingfanzudingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the...3.7 Low
- microsoft windowsThe on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online...7.4 High
- portabilis i-educarPortabilis i-Educar turma improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar enturmar access control5.3 Medium
- Show moreLoading…