CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- abb flxeonRemote Code Execution7.5 High
- phpgurukul online course registrationPHPGurukul Online Course Registration my-profile.php sql injection6.9 Medium
- seacmsSeaCMS admin_members.php sql injection5.1 Medium
- wplegalpages privacy policy generator – wplp legal pagesPrivacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation8.1 High
- nko ghost kit – page builder blocks, motion effects & extensionsGhost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- powerdns dnsdistDenial of service via crafted DoH exchange in PowerDNS DNSdist3.7 Low
- paraşüt software bizmuXSS in Mikrogrup's Bizmu4.7 Medium
- invoke-ai invoke-ai/invokeaiPath Traversal and Arbitrary File Deletion in invoke-ai/invokeai9.8 Critical
- prasunsen chained quizChained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie5.3 Medium
- nokia cbis,ncsRemote Code Execution8.4 High
- nokia cbis,ncsAuthentication Bypass8.8 High
- ninjaforms ninja formsNinja-forms < 3.11.1 - Unauthenticated PHP Objection9.8 Critical
- thimpress wp hotel bookingWP Hotel Booking < 2.2.3 - Subscriber+ Rating Manipulation9.1 Critical
- unknown password reset with code for wordpress rest apiPassword Reset with Code < 0.0.17 - Insecure Password Reset Code Creation9.8 Critical
- wangchenyi1996 chat forumwangchenyi1996 chat_forum q.php cross site scripting5.1 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X Environment Variable goahead sub_412E7C command injection5.3 Medium
- facebook-riares online petshop management systemitsourcecode Online Petshop Management System Admin Dashboard availableframe.php cross site scripting5.1 Medium
- facebook-riares online petshop management systemitsourcecode Online Petshop Management System Available Products addcnp.php cross site scripting5.1 Medium
- d-link dir-852, dlink dir-852 firmware +1 moreD-Link DIR-852 Simple Service Discovery Protocol Service cgibin ssdpcgi_main command injection5.3 Medium
- d-link dir-852, dlink dir-852 firmware +1 moreD-Link DIR-852 Web Management hedwig.cgi command injection5.3 Medium
- purevpnPureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the...3.7 Low
- purevpnPureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside...3.7 Low
- realme clone phoneIn realme BackupRestore app v15.1.12_2810c08_250314, improper URI scheme handling in com.coloros...6.1 Medium
- h3c magic nx15 firmwareH3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to...8.0 High
- comfast cf-xr11 firmwareA command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe...8.8 High
- oxygenz clipbucketAn issue in ClipBucket 5.5.0 and prior versions allows an unauthenticated attacker can exploit...7.3 High
- oxygenz clipbucketAn issue Clip Bucket v.5.5.2 Build#90 allows a remote attacker to execute arbitrary codes via the...6.5 Medium
- No product listedCross Site Request Forgery (CSRF) vulnerability in Smartvista BackOffice SmartVista Suite 2.2.22...7.8 High
- No product listedAn issue in user interface in Kyocera Command Center RX EXOSYS M5521cdn allows remote to obtain...8.8 High
- janobe online exam form submissionSourceCodester Online Exam Form Submission delete_user.php sql injection5.3 Medium
- janobe online exam form submissionSourceCodester Online Exam Form Submission update_s3.php sql injection5.3 Medium
- janobe online exam form submissionSourceCodester Online Exam Form Submission dashboard.php sql injection5.3 Medium
- phpgurukul user management systemPHPGurukul User Management System login.php sql injection6.9 Medium
- fabian hotel reservation systemSourceCodester Hotel Reservation System deleteuser.php sql injection6.9 Medium
- nvidia dgx gb200, hgx gb300, hgc b300, hgx gb200, hgx gb300, hgc b300 +1 moreNVIDIA HGX & DGX GB200, GB300, B300 contain a vulnerability in the HGX Management Controller ...6.7 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker may...8.0 High
- fabian hotel reservation systemSourceCodester Hotel Reservation System editroomimage.php sql injection6.9 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker...4.4 Medium
- nvidia triton inference serverNVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker...7.5 High
- nvidia triton inference serverNVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker...7.5 High
- nvidia triton inference serverNVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python...9.8 Critical
- angeljudesuarez online clinic management systemitsourcecode Online Clinic Management System editp2.php sql injection5.3 Medium
- frappe learning, lms +1 moreFrappe Learning vulnerable to Malicious Content upload via Profile bio field4.6 Medium
- sequa-ai sequa-mcpsequa-ai sequa-mcp OAuth Server Discovery node-oauth-client-provider.ts redirectToAuthorization os command injection5.3 Medium
- angeljudesuarez online clinic management systemitsourcecode Online Clinic Management System transact.php sql injection5.3 Medium
- ashlar cobaltAshlar-Vellum Cobalt LI File Parsing Use-After-Free Remote Code Execution Vulnerability7.8 High
- ashlar cobaltAshlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability7.8 High
- ashlar cobaltAshlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability7.8 High
- ashlar cobaltAshlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability7.8 High
- ashlar cobaltAshlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability7.8 High
- Show moreLoading…