CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- No product listedKilo Code Prompt ClineProvider.ts ClineProvider injection5.3 Medium
- totolink n600r, n600r firmware +1 moreTOTOLINK N600R HTTP Request cstecgi.cgi setWiFiBasicConfig buffer overflow8.7 High
- jhumanj opnformJhumanJ OpnForm Forgotten Password email information exposure6.3 Medium
- jhumanj opnformJhumanJ OpnForm API Endpoint cross-site request forgery5.3 Medium
- jhumanj opnformJhumanJ OpnForm HTTP Header excessive authentication6.3 Medium
- jhumanj opnformJhumanJ OpnForm edit access control5.3 Medium
- duckduckgo browserExposure of Sensitive Information4.7 Medium
- jhumanj opnformJhumanJ OpnForm integrations authorization5.3 Medium
- jhumanj opnformJhumanJ OpnForm API Endpoint custom-domains authorization5.3 Medium
- jhumanj opnformJhumanJ OpnForm Form Editor forms cross site scripting4.8 Medium
- unknown find me onFind Me On <= 2.0.9.1 - Subscriber+ SQL Injection7.7 High
- jhumanj opnformJhumanJ OpnForm answer unrestricted upload5.3 Medium
- jhumanj opnformJhumanJ OpnForm submissions cross site scripting5.3 Medium
- ays-pro chartify – wordpress chart pluginChartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function5.3 Medium
- fabian student transcript processing systemitsourcecode Student Transcript Processing System login.php sql injection6.9 Medium
- codeastro leave management systemitsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting5.1 Medium
- codeastro leave management systemitsourcecode Leave Management System reset.php sql injection6.9 Medium
- metagauss registrationmagic – custom registration forms, user registration, payment, and user loginRegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection7.2 High
- code-projects web-based inventory and pos systemcode-projects Web-Based Inventory and POS System transaction.php sql injection5.3 Medium
- janobe simple e-commerce bookstoreSourceCodester Simple E-Commerce Bookstore cart.php sql injection6.9 Medium
- jackdewey community eventsCommunity Events <= 1.5.1 - Unauthenticated SQL Injection9.8 Critical
- stylemix motors – car dealership & classified listings pluginMotors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion8.1 High
- projectworlds advanced library management systemprojectworlds Advanced Library Management System edit_book.php unrestricted upload5.3 Medium
- projectworlds advanced library management systemprojectworlds Advanced Library Management System edit_admin.php cross site scripting4.8 Medium
- code-projects web-based inventory and pos systemcode-projects Web-Based Inventory and POS System login.php sql injection6.9 Medium
- tenda ch22, ch22 firmware +1 moreTenda CH22 SafeEmailFilter formSafeEmailFilter memory corruption9.3 Critical
- campcodes advanced online voting management system, advanced online voting system +1 moreCampcodes Advanced Online Voting Management System login.php sql injection6.9 Medium
- code-projects voting systemcode-projects Voting System candidates_edit.php cross site scripting5.1 Medium
- denoDeno is Vulnerable to Command Injection on Windows During Batch File Execution8.1 High
- denoDeno's --deny-read check does not prevent permission bypass3.3 Low
- compugroup medical cgm medicoAn insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows...8.6 High
- akilli commerce software technologies ltd. co. e-commerce websitecode-projects E-Commerce Website edit_order_details.php sql injection6.9 Medium
quickjsOSS-FuzzUse-of-uninitialized-value in JS_DefinePropertyNo score- tenda ch22, ch22 firmware +1 moreTenda CH22 HTTP Request AdvSetWrlsafeset formWrlsafeset stack-based overflow9.3 Critical
- go standard library net/mailExcessive CPU consumption in ParseAddress in net/mail7.5 High
- go standard library net/textproto, golang go +1 moreExcessive CPU consumption in Reader.ReadResponse in net/textproto5.3 Medium
- go standard library encoding/pem, golang go +1 moreQuadratic complexity when parsing some invalid inputs in encoding/pem7.5 High
- ruby uriURI Credential Leakage Bypass over CVE-2025-272212.1 Low
github.com/casdoor/casdoorGo,govulncheck-vulndbopenSUSE +1 moreCasdoor is vulnerable to Improper Authorization7.2 High- webreinvent vaahcmsVaahCMS is vulnerable to XSS through its Avatar Upload endpoint6.1 Medium
- ghostxbh uzy-ssm-mallA fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute...6.5 Medium
- ghostxbh uzy-ssm-mallAn XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1...6.5 Medium
- redragon-erpredragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the...6.5 Medium
- 5kcrm wukong crmWukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the ...6.5 Medium
- mayurik pet grooming management softwareSourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS)...6.1 Medium
- configuroweb simple web inventory systemConfiguroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS)...5.4 Medium
- rems link status checkerSourcecodester Link Status Checker 1.0 is vulnerable to a Cross-Site Scripting (XSS) in the Enter...6.1 Medium
- projectworlds gym management systemProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in...8.8 High
- xxyopen novel-plusNovel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability...5.4 Medium
- xxyopen novel-plusNovel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS)...5.4 Medium
- Show moreLoading…