CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- labredescefetrj wegiaWeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'listar_despachos.php' parameter 'id_memorando'8.9 High
- chancmsChanCMS search sql injection5.3 Medium
- campcodes online loan management systemCampcodes Online Loan Management System ajax.php sql injection6.9 Medium
- labredescefetrj wegiaWeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'exibe_anexo.php' parameter 'id_anexo'8.9 High
- labredescefetrj wegiaWeGIA vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint 'listar_despachos.php' parameter 'id_memorando'2.1 Low
- ibm concert, concert software +1 moreIBM Concert Software information disclosure5.9 Medium
- ieaturanium238 cattownCattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource Consumption8.7 High
- campcodes online loan management systemCampcodes Online Loan Management System ajax.php sql injection6.9 Medium
- prestpREST has Systemic SQL Injection Vulnerability9.3 Critical
- chancmsyanyutao0402 ChanCMS search sql injection5.3 Medium
- mahocommerce mahoMaho Vulnerable to Authenticated Remote Code Execution via File Upload8.7 High
- mcpjam inspectorMCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server8.6 High
- xwiki-contrib application-blogXWiki Blog Application: Privilege Escalation (PR) from account through blog content8.7 High
- qix- colorcolor@5.0.1 contains malware after npm account takeover8.8 High
- ethyca fidesFides Webserver API is Vulnerable to OAuth Client Privilege Escalation8.6 High
- ethyca fidesFides Webserver API Rate Limiting Vulnerability in Proxied Environments6.3 Medium
- ethyca fidesFides Lacks Brute-Force Protections on Authentication Endpoints1.7 Low
- chancmsyanyutao0402 ChanCMS search sql injection5.3 Medium
- ethyca fidesFides's Admin UI User Password Change Does Not Invalidate Current Session1.7 Low
- carmelo online event judging systemcode-projects Online Event Judging System review_search.php sql injection6.9 Medium
- akoskm create-mcp-server-stdio@akoskm/create-mcp-server-stdio has Command Injection in MCP Server due to unsafe `exec` API9.3 Critical
- kovah linkaceLinkAce has a Stored One Click XSS vulnerability8.4 High
- carmelo online event judging systemcode-projects Online Event Judging System home.php sql injection6.9 Medium
- dell powerscale onefsDell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper privilege management...6.7 Medium
- carmelo online event judging systemcode-projects Online Event Judging System index.php sql injection6.9 Medium
- dreamstechnologies doccureDoccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change9.8 Critical
- dreamstechnologies doccure coreDoccure Core <= 1.5.3 - Unauthenticated Arbitrary File Upload9.8 Critical
- dreamstechnologies doccureDoccure <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- sourcecodester simple forum discussion system, oretnom23 simple forum\/discussion system +1 moreSourceCodester Simple Forum Discussion System admin_class.php sql injection6.9 Medium
- portabilis i-educarPortabilis i-Educar Editar usuário educar_usuario_cad.php cross site scripting4.8 Medium
- phpgurukul user management systemPHPGurukul User Management System edit-user-profile.php sql injection5.3 Medium
- simSimStudioAI sim route.ts code injection5.3 Medium
- simSimStudioAI sim route.ts server-side request forgery5.3 Medium
- qix- color-convertcolor-convert@3.1.1 contains malware after npm account takeover8.8 High
- qix- color-stringcolor-string@2.1.1 contains malware after npm account takeover8.8 High
- qix- node-backslashbackslash@0.2.1 contains malware after npm account takeover8.8 High
- qix- node-is-arrayishis-arrayish@0.3.3 contains malware after npm account takeover8.8 High
- qix- node-simple-swizzlesimple-swizzle@0.2.3 contains malware after npm account takeover8.8 High
- pjuhasz json::simdJSON::SIMD before version 1.07 and earlier for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact7.5 High
- rurban cpanel::json::xsCpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact5.6 Medium
- mlehmann json::xsJSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact7.5 High
- colorjs color-namecolor-name@2.0.1 contains malware after npm account takeover8.8 High
- qix- node-error-exerror-ex@1.3.3 contains malware after npm account takeover8.8 High
- sqlite fts5Out Of Bounds write in FTS5 Extension in SQLite6.9 Medium
- debug-js debugdebug@4.4.2 contains malware after npm account takeover8.8 High
- microsoft .net 6.0EOL .NET 6.0 Runtime Remote Code Execution Vulnerability8.8 High
- microsoft .net 6.0, microsoft.aspnetcore.app.runtime.linux-arm, microsoft.aspnetcore.app.runtime.linux-arm64 +11 more +13 moreEOL ASP.NET 6.0 Remote Code Execution Vulnerability8.1 High
- microsoft .net 6.0, microsoft.netcore.app.runtime.linux-arm, microsoft.netcore.app.runtime.linux-arm64 +10 more +12 moreEOL .NET 6.0 Runtime Remote Code Execution Vulnerability7.5 High
- d-link dir-852, dlink dir-852 firmware +1 moreD-Link DIR-852 Device Configuration getcfg.php phpcgi_main information disclosure6.9 Medium
ironcrates.ioiron crate is unmaintainedNo score- Show moreLoading…