CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- campcodes online learning management systemCampcodes Online Learning Management System teachers.php sql injection6.9 Medium
- campcodes online learning management systemCampcodes Online Learning Management System edit_department.php sql injection6.9 Medium
- campcodes online learning management systemCampcodes Online Learning Management System save_student.php sql injection6.9 Medium
- campcodes online learning management systemCampcodes Online Learning Management System edit_student.php sql injection6.9 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software print_inv.php sql injection6.9 Medium
- oranbyte school management systemProjectsAndPrograms School Management System select-students.php sql injection5.3 Medium
- code-projects online hotel reservation systemSourceCodester Online Hotel Reservation System updateaddress.php sql injection6.9 Medium
- angeljudesuarez open source job portalitsourcecode Open Source Job Portal index.php sql injection5.3 Medium
- phpgurukul small crmPHPGurukul Small CRM forgot-password.php sql injection6.9 Medium
- kidaze courseselectionsystemkidaze CourseSelectionSystem COUNT3s5.php sql injection6.9 Medium
- milankyada vm menu reorder pluginVM Menu Reorder plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- kelderic professional contact formProfessional Contact Form <= 1.0.0 - Cross-Site Request Forgery to Test Email Sending4.3 Medium
- compojoom cforms – light speed fast form buildercForms – Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgery4.3 Medium
- trustreviews trust reviews plugin for google, tripadvisor, yelp, airbnb and other platformsTrust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms <= 1.0 - Cross-Site Request Forgery6.1 Medium
- cristianr909090 sync feedlySync Feedly <= 1.0.1 - Cross-Site Request Forgery to Sync Trigger4.3 Medium
- funnnny hidepostHidePost <= 2.3.8 - Cross-Site Request Forgery4.3 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software cross-site request forgery5.3 Medium
- algolia algoliasearch-helperalgoliasearch-helper is vulnerable to Prototype Pollution in _merge()7.5 High
- textit phonenumbersgithub.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input6.9 Medium
- portabilis i-educarPortabilis i-Educar periodo-lancamento improper authorization5.3 Medium
- veronalabs wp statistics – simple, privacy-friendly google analytics alternativeWP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header7.2 High
- portabilis i-educarPortabilis i-Educar unificacao-aluno improper authorization5.3 Medium
- kstover ninja forms – the contact form builder that grows with you, ninjaforms ninja forms +1 moreNinja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion4.3 Medium
- kstover ninja forms – the contact form builder that grows with you, ninjaforms ninja forms +1 moreNinja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- spwebguy team membersTeam Members <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- ibm storage ts4500 library, diamondback tape library firmware, storage ts4500 library firmware +2 moreIBM Storage TS4500 Library cross-site scripting6.1 Medium
- ibm storage ts4500 library, diamondback tape library firmware, storage ts4500 library firmware +2 moreIBM Storage TS4500 Library cross-site request forgery6.5 Medium
- syslifters sysreptorSysReptor Susceptible to Privilege Escalation by Authenticated Users8.1 High
- flagforgeFlagForgeCTF Unauthenticated Resource Modification/Deletion8.6 High
- labredescefetrj wegiaWeGIA vulnerable to SQL Injection into method `excluir` of the `ProdutoControle` class in the parameter `id_produto`.8.8 High
- wazuhHeap buffer overflow in wazuh-analysisd6.5 Medium
openexrOSS-FuzzHeap-buffer-overflow in DwaCompressor_uncompressNo score- ibm watsonx.dataIBM watsonx.data information disclosure3.3 Low
- formbricksFormbricks missing JWT signature verification9.4 Critical
- portabilis i-educarPortabilis i-Educar consulta-dispensas improper authorization5.3 Medium
- portabilis i-educarPortabilis i-Educar aluno improper authorization5.3 Medium
- docker desktopDocker Desktop with ECI Fails to Enforce Socket Command Restrictions8.7 High
- tencent weknoraTencent WeKnora test testEmbeddingModel server-side request forgery6.9 Medium
- wayos lq 04, lq 05, lq 06 +2 more +4 moreWAYOS LQ_04/LQ_05/LQ_06/LQ_07/LQ_09 usb_paswd.asp command injection6.9 Medium
- angeljudesuarez open source job portalitsourcecode Open Source Job Portal index.php sql injection5.3 Medium
- angeljudesuarez hostel management systemcode-projects Hostel Management System index.php sql injection6.9 Medium
- campcodes computer sales and inventory systemCampcodes Computer Sales and Inventory System us_edit1.php sql injection6.9 Medium
- angeljudesuarez online clinic management systemitsourcecode Online Clinic Management System details.php sql injection5.3 Medium
- akilli commerce software technologies ltd. co. e-commerce websitecode-projects E-Commerce Website admin_index_search.php sql injection6.9 Medium
- akilli commerce software technologies ltd. co. e-commerce websitecode-projects E-Commerce Website admin_account_update.php sql injection6.9 Medium
- jinher oaJinher OA text xml external entity reference5.3 Medium
- dibo data decision making systemDibo Data Decision Making System common_dep.action.jsp downloadImpTemplet path traversal5.3 Medium
- kidaze courseselectionsystemkidaze CourseSelectionSystem COUNT3s7.php sql injection6.9 Medium
- kidaze courseselectionsystemkidaze CourseSelectionSystem COUNT3s6.php sql injection6.9 Medium
- sprymedia datatablesDataTables examples.php path traversal6.9 Medium
- Show moreLoading…