CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- sound4 pulse-eco aes67 firmwareThe Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code...8.8 High
- creacast creabox managerCreacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible...7.5 High
- inilabs school expressiNiLabs School Express (SMS Express) 6.2 is affected by a Stored Cross-Site Scripting (XSS)...5.4 Medium
- ui-lib stockyStocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross...5.4 Medium
- liquidlabs magicaiMagicProject AI version 9.1 is affected by a Cross-Site Scripting (XSS) vulnerability within the...4.8 Medium
- phpgurukul park ticketing management systemA SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of...5.4 Medium
- phpgurukul park ticketing management systemA SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of...9.8 Critical
- ard gec en ligneCross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint...7.3 High
- ard gec en ligneCross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD. The...6.1 Medium
- No product listedAn Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD. The flaw exists...6.5 Medium
- ard gec en ligneSQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04...6.3 Medium
- pivotxCross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute...5.4 Medium
- broadcom tcpreplayWithin tcpreplay's tcprewrite, a double free vulnerability has been identified in the...7.8 High
- No product listedIn 2wcom IP-4c 2.16, the web interface allows admin and manager users to execute arbitrary code...8.8 High
- hugging face lerobothuggingface LeRobot ZeroMQ Socket lekiwi_remote.py missing authentication5.3 Medium
- jeecg jimureportjeecgboot JimuReport DB2 JDBC testConnection deserialization5.3 Medium
- jeecg jimureportjeecgboot JimuReport MySQL JDBC testConnection deserialization5.3 Medium
- cosmodiumcs onlyratCosmodiumCS OnlyRAT Configuration File main.py remote_download os command injection2.0 Low
- sitecore experience platform (xp), experience manager (xm) +1 moreSitecore Experience Platform Cross-Site Scripting Vulnerability7.1 High
ammoniacrates.ioAmmonia incorrectly handles embedded SVG and MathML leading to mutation XSS after removal1.7 Low- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization5.3 Medium
- h2o, h2oai h2o-3 +1 moreh2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization5.3 Medium
- h2o, h2oai h2oai/h2o-3 +1 moreDeserialization Vulnerability in h2oai/h2o-39.8 Critical
- seriawei zkeacmsSeriaWei ZKEACMS EventViewerController.cs Download path traversal5.3 Medium
- seriawei zkeacmsSeriaWei ZKEACMS SEOSuggestions ZKEACMS.SEOSuggestions.dll server-side request forgery5.1 Medium
- seriawei zkeacmsSeriaWei ZKEACMS Event Action System PendingTaskController.cs Edit server-side request forgery5.3 Medium
- academico-sis academicoacademico-sis academico Profile Picture edit-photo unrestricted upload5.3 Medium
- kuaifan dootaskkuaifan DooTask UsersController.php sql injection5.3 Medium
- No product listedHarness Login Endpoint login excessive authentication6.3 Medium
- No product listedHarness lookup_repo.go LookupRepo server-side request forgery5.3 Medium
- webkul qloappsWebkul QloApps CSRF Token authorization6.9 Medium
- htmlyhtmly Custom Field post cross site scripting4.8 Medium
- ffmpegFfmpeg: double-free vulnerability in ffmpeg tensorflow dnn backend3.3 Low
- utt 1200gw, 1200gw firmware +1 moreUTT 1200GW formConfigDnsFilterGlobal buffer overflow8.7 High
- utt hiper 840g, 840g firmware +1 moreUTT HiPER 840G getOneApConfTempEntry buffer overflow8.7 High
- selleo mentingoSelleo Mentingo Content-Type unrestricted upload5.3 Medium
- bluefeet starchStarch versions 0.14 and earlier generate session ids insecurely9.1 Critical
- selleo mentingoSelleo Mentingo Profile Picture unrestricted upload5.3 Medium
- bittokazi custom login and signup widgetCustom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery4.3 Medium
- bpedrassani browser sniffBrowser Sniff <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- michaelbo osticket wp bridgeosTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- psmplugins supportcandy – helpdesk & customer support ticket systemSupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover6.5 Medium
- webraketen internal links managerInternal Links Manager <= 3.0.1 - Cross-Site Request Forgery4.3 Medium
- clickwhale – link manager, link shortener and click tracker for affiliate links & link pagesClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection4.9 Medium
- brainstormforce sureforms – contact form, payment form & other custom form builderSureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation4.3 Medium
- endisha secure passkeysSecure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion5.3 Medium
- dartiss draft listDraft List <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- robcore89 robcore netatmoRobcore Netatmo <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode6.5 Medium
tinyusbOSS-FuzzUNKNOWN READ in dcd_int_handlerNo scorevlcOSS-FuzzHeap-buffer-overflow in OpenNo score- Show moreLoading…