CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- magdesign pocketvj control panel firmwareAn issue in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 allows remote attackers to execute arbitrary...6.5 Medium
- cszcms csz cmsSQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code...6.5 Medium
- cszcms csz cmsSQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code...6.5 Medium
- axboe fioaxboe fio options.c str_buffer_pattern_cb null pointer dereference4.8 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll SysSmsLogController improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll TopicCategoryController improper authorization5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP audit events record password reminder answers6.9 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll TopicController improper authorization5.3 Medium
- fuyang lipengjun platformfuyang_lipengjun platform queryAll UserCouponController improper authorization5.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP allows users to add a note to a different virtual instance5.3 Medium
- campcodes online learning management systemCampcodes Online Learning Management System admin_user.php sql injection6.9 Medium
- dnnsoftware dotnetnuke, dnn.platform +1 moreDNN affected by Stored Cross-Site Scripting (XSS) in Profile Biography field6.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP does not properly check permission with import and export tasks5.3 Medium
- jinher oaJinher OA XML text xml external entity reference6.9 Medium
- tenda ac20, ac20 firmware +1 moreTenda AC20 HTTP POST Request SetPptpServerCfg strcpy buffer overflow8.7 High
- dnnsoftware dotnetnuke, dnn.platform +1 moreDotNetNuke.Core allows loading of unused themes on anonymous clients through query parameters6.5 Medium
- d-link dir-823x, dlink dir-823x firmware +1 moreD-Link DIR-823X goahead command injection5.3 Medium
- angeljudesuarez hostel management systemcode-projects Hostel Management System index.php sql injection6.9 Medium
- flowiseai flowiseCritical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function9.6 Critical
- angeljudesuarez hostel management systemcode-projects Hostel Management System index.php sql injection6.9 Medium
- angeljudesuarez hostel management systemcode-projects Hostel Management System index.php sql injection6.9 Medium
- autodesk shared componentsPRT File Parsing Memory Corruption Vulnerability7.8 High
- frontfin mesh-web-sdkMesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink8.2 High
- is-localhost-ipis-localhost-ip 2.0.0 - SSRF via Restrictions bypass6.9 Medium
- campcodes online learning management systemCampcodes Online Learning Management System edit_user.php sql injection6.9 Medium
- loopus wp attractive donations systemWordPress WP Attractive Donations System Plugin < 1.29 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- vikas ratudi vpsuformWordPress VPSUForm Plugin <= 3.2.20 - Broken Access Control Vulnerability4.3 Medium
- publitioWordPress Publitio Plugin <= 2.2.1 - Server Side Request Forgery (SSRF) Vulnerability6.4 Medium
- brijeshk89 ip based loginWordPress IP Based Login Plugin <= 2.4.3 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- agency dominion inc. fusion page builder : extension – galleryWordPress Fusion Page Builder : Extension – Gallery Plugin <= 1.7.6 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- christiaan pieterse maxiblocksWordPress MaxiBlocks Plugin <= 2.1.3 - Broken Access Control Vulnerability5.0 Medium
- hashthemes easy elementor addonsWordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerability7.5 High
- greg winiarski custom login urlWordPress Custom Login URL Plugin <= 1.0.2 - Broken Access Control Vulnerability5.3 Medium
- stellarwp wpcompleteWordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- implecode product catalog simpleWordPress Product Catalog Simple Plugin <= 1.8.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- wp chill revive.soWordPress Revive.so Plugin <= 2.0.6 - Broken Access Control Vulnerability4.3 Medium
- fatcatapps getresponse formsWordPress GetResponse Forms Plugin <= 2.6.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- pdfcrowd dev team save as pdfWordPress Save as PDF Plugin <= 4.5.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- payrexx payment gateway for woocommerceWordPress Payrexx Payment Gateway for WooCommerce Plugin <= 3.1.5 - Broken Access Control Vulnerability4.3 Medium
- coderz studio custom iframe for elementorWordPress Custom iFrame for Elementor Plugin <= 1.0.13 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- hashthemes smart blocksWordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerability4.3 Medium
- kodezen llc academy lmsWordPress Academy LMS Plugin <= 3.3.4 - Insecure Direct Object References (IDOR) Vulnerability5.5 Medium
- wp swings upsell order bump offer for woocommerceWordPress Upsell Order Bump Offer for WooCommerce Plugin <= 3.0.7 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- elliot sowersby / relywp coupon affiliatesWordPress Coupon Affiliates Plugin <= 6.8.0 - Broken Access Control Vulnerability4.3 Medium
- zoho flow flowWordPress Zoho Flow Plugin <= 2.14.1 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- emraan cheema cubewpWordPress CubeWP Plugin <= 1.1.26 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- purethemes workscout-coreWordPress WorkScout-Core Plugin < 1.7.06 - Cross Site Request Forgery (CSRF) Vulnerability8.8 High
- unknown mail mintWordPress Mail Mint Plugin <= 1.18.6 - SQL Injection Vulnerability7.6 High
- cozythemes cozy blocksWordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection Vulnerability5.3 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS Plugin <= 3.6.20 - Broken Access Control Vulnerability6.5 Medium
- Show moreLoading…