CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- janobe point of salesSourceCodester Point of Sales delete_category.php sql injection5.1 Medium
- janobe point of salesSourceCodester Point of Sales category.php sql injection6.9 Medium
- janobe point of salesSourceCodester Point of Sales index.php sql injection6.9 Medium
- ashymuzuro full-ecommece-website, muzuro ecommerce system +1 moreashymuzuro Full-Ecommece-Website/Muzuro Ecommerce System Add Product index.php unrestricted upload5.1 Medium
- cloud solutions sas wimi teamworkWimi Teamwork < v7.38.17 CSRF7.0 High
- centreon web, infra monitoring +1 moreA user with elevated privileges can inject XSS in the Services Meta-services configuration page6.2 Medium
- honeywell s35 thermal camera, s35 3m/5m/8m/pinhole/kit camera, s35 ai fisheye&dual sensor/micro dome/full color eyeball&bullet camera +2 moreInadequate access control measure allows unauthorized users to access restricted administrative functions6.8 Medium
- sui shang information technology suishang enterprise-level b2b2c multi-user mall systemSui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting5.3 Medium
- sui shang information technology suishang enterprise-level b2b2c multi-user mall systemSui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting5.3 Medium
- ibm openpagesHTML Injection Vulnerability in a Specific URL Endpoint of the IBM OpenPages Application5.4 Medium
- ping identity pingfederatePingFederate unexpected browser flow initiation in redirectless mode0.0 None
- bewelcome roxBeWelcome/Rox PHP Object Injection RCE9.4 Critical
- bdtask pharmacy management system, pharmacare +1 moreBdtask Pharmacy Management System User Profile edit_user authorization5.3 Medium
- bdtask wholesale, wholesale inventory control and inventory management system +1 moreBdtask Wholesale Inventory Control and Inventory Management System edit_profile sql injection5.1 Medium
- No product listedVeePN AVService avservice.exe unquoted search path7.3 High
- code-projects client details systemcode-projects Client Details System authorization5.3 Medium
- docker desktopMultiple DLL Search Order Hijacking Vulnerabilities in Docker Desktop Installer for Windows8.8 High
- openvpn access serverCross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access...6.4 Medium
- code-projects client details systemcode-projects Client Details System manage-users.php cross site scripting4.8 Medium
- code-projects client details systemcode-projects Client Details System clientview.php cross site scripting4.8 Medium
- code-projects client details systemcode-projects Client Details System update-clients.php cross site scripting4.8 Medium
- code-projects client details systemcode-projects Client Details System welcome.php cross site scripting4.8 Medium
- abdullah-hasan-sajjad online-schoolAbdullah-Hasan-Sajjad Online-School studentLogin.php sql injection6.9 Medium
- learnhouseLearnHouse Image information disclosure5.3 Medium
- zohocorp manageengine endpoint centralSensitive Information Logged3.2 Low
- salesagility suitecrmReflected Cross-Site Scripting (XSS) in SuiteCRM5.1 Medium
- newplane open5gsReachable Assertion vulnerability in Open5GS8.7 High
- newplane open5gsReachable Assertion vulnerability in Open5GS8.7 High
- tenda ch22, ch22 firmware +1 moreTenda CH22 P2pListFilter fromP2pListFilter buffer overflow8.7 High
- tenda ch22, ch22 firmware +1 moreTenda CH22 webExcptypemanFilter fromwebExcptypemanFilter buffer overflow8.7 High
- tenda ch22, ch22 firmware +1 moreTenda CH22 addressNat fromAddressNat buffer overflow8.7 High
- tenda ch22, ch22 firmware +1 moreTenda CH22 RouteStatic fromRouteStatic buffer overflow8.7 High
- learnhouseLearnHouse Student Assignment Submission sub_file resource injection5.3 Medium
- disenno de recursos educativos s.l virtual campus platformSQL injection on the virtual campus platform of Diseño de Recursos Educativos9.3 Critical
- learnhouseLearnHouse Account Setting previews cross site scripting5.1 Medium
- learnhouseLearnHouse Course Thumbnail courses unrestricted upload5.3 Medium
- thegreenbow vpn client windows enterpriseIncorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise8.2 High
- abhicodebox modernshopabhicodebox ModernShop search cross site scripting5.3 Medium
- zytec dalian zhuoyun technology central authentication serviceZytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injection5.3 Medium
- tenda ch22, ch22 firmware +1 moreTenda CH22 VirtualSer fromVirtualSer buffer overflow8.7 High
- No product listedWisencode Create Support Ticket create cross site scripting5.1 Medium
- carmelo online event judging systemcode-projects Online Event Judging System edit_judge.php sql injection5.3 Medium
- carmelo online event judging systemcode-projects Online Event Judging System edit_criteria.php sql injection5.3 Medium
- sick tloc100-100 firmware, sick ag tloc100-100 all firmware versions +1 moreDenial-of-service (DoS) via chunk size mismatch4.3 Medium
- sick tloc100-100 firmware, sick ag tloc100-100 all firmware versions +1 moreDenial-of-service (DoS) via delayed or missing client response6.5 Medium
- sick tloc100-100 firmware, sick ag tloc100-100 all firmware versions +1 moreAPI does not require authentication7.6 High
- sick tloc100-100 firmware, sick ag tloc100-100 with firmware <7.1.1, tloc100-100 with firmware >=7.1.1 +2 moreUnsecure access configuration7.5 High
- sick tloc100-100 firmware, sick ag tloc100-100 +1 moreDenial-of-service (DoS) via resource consumption5.5 Medium
- centreon infra monitoringCentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON8.4 High
- code-projects gym management systemCodeAstro Gym Management System remove-announcement.php sql injection5.3 Medium
- Show moreLoading…