CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- sap se hcm (my timesheet fiori 2.0 application)Missing Authorization check in SAP HCM (My Timesheet Fiori 2.0 application)6.5 Medium
- sap se netweaver (service data download), sap basis +1 moreMissing Authorization check in SAP NetWeaver (Service Data Download)5.0 Medium
- No product listeduverif kami_list addbatch sql injection5.3 Medium
- tenda ac20, ac20 firmware +1 moreTenda AC20 GetParentControlInfo strcpy buffer overflow8.7 High
- emiloi e-logbook with health monitoring system for covid-19itsourcecode E-Logbook with Health Monitoring System for COVID-19 login.php sql injection6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to XSS attack through fieldset name in Kaleo Forms Admin4.8 Medium
- chuck24 simple to-do list systemSourceCodester Simple To-Do List System Add New Task fetch_tasks.php cross site scripting5.1 Medium
- No product listedSiempreCMS file_upload.php unrestricted upload6.9 Medium
- No product listedSiempreCMS user_search_ajax.php sql injection6.9 Medium
- phpgurukul small crmPHPGurukul Small CRM profile.php sql injection6.9 Medium
- itsourcecode student information management systemitsourcecode Student Information Management System index.php sql injection6.9 Medium
- element-plusElement Plus Link component (el-link) implements insufficient input validation for the href attribute6.4 Medium
- No product listedA command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated...9.8 Critical
- proxmox virtual environmentA stored cross-site scripting (XSS) vulnerability exists in the WebAuthn Relying Party field...5.4 Medium
- proxmox virtual environmentA stored cross-site scripting (XSS) vulnerability in the U2F Origin field of the Datacenter...5.4 Medium
- proxmox virtual environmentA stored cross-site scripting (XSS) vulnerability in the HTTP Proxy field within the Datacenter...5.4 Medium
- lb-link bl-cpe300m firmwareThe LB-Link BL-CPE300M AX300 4G LTE Router firmware version BL-R8800_B10_ALK_SL_V01.01...8.8 High
- tenda w30e firmwareTenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the countryCode...7.5 High
- tenda w30e firmwareTenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the String parameter...7.5 High
- tenda w30e firmwareTenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in...9.8 Critical
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the staticRouteGateway...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the vpnUsers parameter...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the gstUp parameter in...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the pPppUser parameter...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the bindDhcpIndex...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the portMappingIndex...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the delDhcpIndex...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the rules parameter in...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the dhcpIndex parameter...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain multiple stack overflows in the...7.5 High
- tenda g3 firmwareTenda G3 v3.0br_V15.11.0.17 was discovered to contain a stack overflow in the listStr parameter...7.5 High
- No product listedK7RKScan.sys 23.0.0.10, part of the K7 Security Anti-Malware suite, allows an admin-privileged...7.2 High
- open5gsAn issue in Open5GS v2.7.2 and before allows a remote attacker to cause a denial of service via a...7.5 High
- yeswikiYesWiki Cross Site Scripting vulnerability6.1 Medium
- haloHalo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.6.1 Medium
- halohalo v2.20.17 and before is vulnerable to server-side request forgery (SSRF) in /apis/uc.api...9.1 Critical
- haloHalo prior to 2.20.13 allows bypassing file type detection and uploading malicious files such as ...6.1 Medium
- No product listedAn issue in TP-Link AX10 Ax1500 v.1.3.10 Build (20230130) allows a remote attacker to obtain...7.5 High
- monai medical open network for ai, project-monai monai +1 moreMONAI's unsafe use of Pickle deserialization may lead to RCE8.8 High
- monai medical open network for ai, project-monai monai +1 moreMONAI's unsafe torch usage may lead to arbitrary code execution8.8 High
- monai medical open network for ai, project-monai monai +1 moreMONAI has path traversal issue that may lead to arbitrary file writes8.8 High
- itsourcecode student information management systemitsourcecode Student Information Management System index.php sql injection6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal is vulnerable to SSRF through custom object attachment fields4.8 Medium
- itsourcecode student information management systemitsourcecode Student Information Management System index.php sql injection6.9 Medium
- vitejs viteVite's `server.fs` settings were not applied to HTML files2.3 Low
- vitejs viteVite middleware may serve files starting with the same name with the public directory2.3 Low
- volkovlabs business-linksVolkov Labs Business Links plugin vulnerable to privilege escalation attack9.1 Critical
- labredescefetrj wegiaWeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)10.0 Critical
- Show moreLoading…