CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- ibm powervm hypervisorIBM PowerVM Hypervisor denial of service6.7 Medium
- lg electronics ac smart iiUnauth Admin Reset Password on AC Smart II7.1 High
- fcba zzm ics-park smart park management system, smart park management system +1 morefcba_zzm ics-park Smart Park Management System FileUploadUtils.java unrestricted upload5.3 Medium
daemonizecrates.io`daemonize` is UnmaintainedNo score- maccmsMagicblack MacCMS API server-side request forgery5.1 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software edit_role.php sql injection6.9 Medium
- maccmsMagicblack MacCMS Scheduled Task col_url server-side request forgery5.1 Medium
- fcba zzm ics-park smart park management system, smart park management system +1 morefcba_zzm ics-park Smart Park Management System Scheduled Task JobController.java code injection5.1 Medium
- miurla morphicmiurla morphic HTTP Status Code 3xx advanced-search fetchHtml server-side request forgery5.3 Medium
- mercury km08-708h giga wifi wave2Mercury KM08-708H GiGA WiFi Wave2 HTTP Header stack-based overflow9.3 Critical
- crmebCRMEB OutAccountServices.php testOutUrl server-side request forgery5.3 Medium
- crmebCRMEB UserAddressServices.php editAddress improper authorization5.3 Medium
- crmebCRMEB Administrator Password SystemAdminServices.php save improper authorization5.3 Medium
- selleo mentingoSelleo Mentingo Create New Course Basic Settings enroll-course cross site scripting5.1 Medium
- codesiddhant jasmin ransomwarecodesiddhant Jasmin Ransomware handshake.php sql injection5.3 Medium
- yida ecms consulting enterprise management systemYida ECMS Consulting Enterprise Management System POST Request login.do cross site scripting5.3 Medium
- mercury km08-708h giga wifi wave2Mercury KM08-708H GiGA WiFi Wave2 mcr_setSysAdm sub_450B2C buffer overflow8.7 High
tinyusbOSS-FuzzNull-dereference READ in ubsan_GetStackTraceNo score- express xss sanitizer project xss sanitizerexpress-xss-sanitizer has an unbounded recursion depth5.3 Medium
- one identity oneloginIn One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps...7.7 High
- ruoyiyangzongzhuan RuoYi Role cancelAll improper authorization5.3 Medium
- shenzhen sixun business management systemShenzhen Sixun Business Management System OperatorStop improper authorization6.9 Medium
- portabilis i-educarPortabilis i-Educar educar_turma_tipo_cad.php cross site scripting5.1 Medium
- portabilis i-educarPortabilis i-Educar educar_modulo_cad.php cross site scripting5.1 Medium
- echarge hardy barth salia plcceCharge Hardy Barth Salia PLCC api.php unrestricted upload6.9 Medium
- miczflor rpi-jukebox-rfidMiczFlor RPi-Jukebox-RFID userScripts.php cross site scripting5.1 Medium
- miczflor rpi-jukebox-rfidMiczFlor RPi-Jukebox-RFID cardRegisterNew.php cross site scripting5.1 Medium
- miczflor rpi-jukebox-rfidMiczFlor RPi-Jukebox-RFID manageFilesFolders.php cross site scripting5.1 Medium
- miczflor rpi-jukebox-rfidMiczFlor RPi-Jukebox-RFID cardEdit.php cross site scripting5.1 Medium
- miczflor rpi-jukebox-rfidMiczFlor RPi-Jukebox-RFID inc.setWlanIpMail.php cross site scripting5.1 Medium
- wavlink wl-wn578w2, wl-wn578w2 firmware +1 moreWavlink WL-WN578W2 wireless.cgi sub_404DBC os command injection6.9 Medium
- wavlink wl-wn578w2, wl-wn578w2 firmware +1 moreWavlink WL-WN578W2 wireless.cgi sub_404850 os command injection6.9 Medium
- whatcd gazelleWhatCD Gazelle Commit Message change_log.php cross site scripting5.1 Medium
- cdevroe unmarkcdevroe unmark info.php cross site scripting5.1 Medium
- cdevroe unmarkcdevroe unmark Marks.php cross site scripting5.1 Medium
htslibOSS-FuzzUNKNOWN READ in sam_hrecs_free_tagsNo scorendpiOSS-FuzzHeap-buffer-overflow in processClientServerHelloNo score- cdevroe unmarkcdevroe unmark searchform.php cross site scripting5.3 Medium
- cdevroe unmarkcdevroe unmark Marks.php server-side request forgery5.3 Medium
- miczflor rpi-jukebox-rfidMiczFlor RPi-Jukebox-RFID playsinglefile.php os command injection5.3 Medium
- tvcnet the hack repair guy's plugin archiverThe Hack Repair Guy's Plugin Archiver <= 2.0.4 - Authenticated (Administrator+) Arbitrary File Deletion7.2 High
- miczflor rpi-jukebox-rfidMiczFlor RPi-Jukebox-RFID shuffle.php os command injection5.3 Medium
- miczflor rpi-jukebox-rfidMiczFlor RPi-Jukebox-RFID single.php os command injection5.3 Medium
- wavlink wl-wn578w2, wl-wn578w2 firmware +1 moreWavlink WL-WN578W2 login.cgi sub_401BA4 command injection5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's System, Instance and Site Settings are vulnerable to Open Redirect5.1 Medium
- wavlink wl-wn578w2, wl-wn578w2 firmware +1 moreWavlink WL-WN578W2 firewall.cgi sub_401C5C command injection6.9 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal: Missing Rate Limiting in GraphQL Endpoint Enables Resource Exhaustion Attack7.1 High
- wavlink wl-wn578w2, wl-wn578w2 firmware +1 moreWavlink WL-WN578W2 wizard_rep.shtml sub_409184 command injection6.9 Medium
- wavlink wl-wn578w2, wl-wn578w2 firmware +1 moreWavlink WL-WN578W2 sysinit.html password recovery6.9 Medium
- flowiseai flowiseFlowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover9.8 Critical
- Show moreLoading…