CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- pickplugins accordionWordPress Accordion Plugin <= 2.3.15 - Broken Access Control Vulnerability6.5 Medium
- gutentorWordPress Gutentor plugin <= 3.5.2 - Broken Access Control vulnerability6.5 Medium
- timur kamaev kama click counterWordPress Kama Click Counter plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jürgen müller easy quotesWordPress Easy Quotes Plugin <= 1.2.4 - Broken Access Control Vulnerability5.3 Medium
- luke mlsna last updated shortcodeWordPress Last Updated Shortcode Plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- themepoints logo showcaseWordPress Logo Showcase plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- quadlayers perfect brands for woocommerceWordPress Perfect Brands for WooCommerce plugin <= 3.6.2 - SQL Injection vulnerability8.5 High
- cecabank woocommerce pluginWordPress Cecabank WooCommerce plugin plugin <= 0.3.4 - Broken Access Control vulnerability5.3 Medium
- wp cms ninja current age pluginWordPress Current Age Plugin Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- casengo live chat supportWordPress Casengo Live Chat Support Plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- tapfiliateWordPress Tapfiliate Plugin <= 3.2.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- russell jamieson genesis club liteWordPress Genesis Club Lite Plugin <= 1.17 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- ptibogxiv doliconnectWordPress Doliconnect Plugin <= 9.5.7 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- webwizards marketkingWordPress MarketKing Plugin <= 2.0.92 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- skyword api pluginWordPress Skyword API Plugin Plugin <= 2.5.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- ren ventura wp delete user accountsWordPress WP Delete User Accounts Plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- ericsson codecheckerBuffer overflow in CodeChecker log command5.9 Medium
- eladnava mailgenMailgen: HTML injection vulnerability in plaintext e-mails2.7 Low
- gsyt-productions bunnypad-srcBunnyPad Vulnerable to Buffer Overflow When Opening Files of Size 20MB or Greater5.5 Medium
- campcodes online learning management systemCampcodes Online Learning Management System department.php sql injection6.9 Medium
- riceball git-commiters, snowyu git-commiters.js +1 more`git-comiters` Command Injection vulnerability8.7 High
- conventional-changelog@conventional-changelog/git-client has an Argument Injection vulnerability5.3 Medium
- campcodes farm management systemCampcodes Farm Management System uploadProduct.php sql injection6.9 Medium
- campcodes online beauty parlor management systemCampcodes Online Beauty Parlor Management System edit-customer-detailed.php sql injection5.3 Medium
- campcodes online beauty parlor management systemCampcodes Online Beauty Parlor Management System bwdates-reports-details.php sql injection5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay has a stored cross-site scripting (XSS) vulnerability via a a publication’s “Name” text field4.8 Medium
- cubecart, cubecart v6 +1 moreCubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parameter6.5 Medium
- cubecart, cubecart v6 +1 moreCubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacement5.4 Medium
- cubecart, cubecart v6 +1 moreCubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquiry5.4 Medium
- cubecart, cubecart v6 +1 moreCubeCart Session Not Invalidated After Password Change7.1 High
- campcodes online beauty parlor management systemCampcodes Online Beauty Parlor Management System add-services.php sql injection5.3 Medium
- airship ai acropolisAirship AI Acropolis default credentials9.3 Critical
- airship ai acropolisAirship AI Acropolis MFA insufficient rate limiting7.7 High
- campcodes online beauty parlor management systemCampcodes Online Beauty Parlor Management System add-customer.php sql injection5.3 Medium
- ibm webmethods integrationIBM webMethods Integration server-side request forgery5.4 Medium
- ibm webmethods integrationIBM webMethods Integration code execution7.5 High
- tenda ac23, ac23 firmware +1 moreTenda AC23 HTTP POST Request SetPptpServerCfg sscanf buffer overflow8.7 High
- ge vernova s1 agile configuration softwareS1 Agile Privilege Escalation7.5 High
- authlibAuthlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)7.5 High
- code-projects online bidding systemcode-projects Online Bidding System remove.php sql injection6.9 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software edit_tax.php sql injection6.9 Medium
- emiloi online discussion forumitsourcecode Online Discussion Forum index.php sql injection6.9 Medium
- angeljudesuarez hostel management systemcode-projects Hostel Management System index.php sql injection6.9 Medium
- angeljudesuarez hostel management systemcode-projects Hostel Management System index.php sql injection6.9 Medium
- No product listedSymlink Following in txtai leads to arbitrary file write when loading untrusted embedding indices8.1 High
- angeljudesuarez hostel management systemcode-projects Hostel Management System index.php sql injection6.9 Medium
- angeljudesuarez hostel management systemcode-projects Hostel Management System login.php sql injection6.9 Medium
- galayou g2Lack of Authentication for RTSP stream7.1 High
- code-projects online bidding systemcode-projects Online Bidding System bidupdate.php sql injection6.9 Medium
- phpgurukul car rental projectPHPGurukul Car Rental Project search.php cross site scripting5.3 Medium
- Show moreLoading…