CVEs published September 1, 2025
84 CVEs were published on September 1, 2025: 6 critical, 21 high.
- Published
- 84
- Critical
- 6
- High
- 21
- Medium
- 53
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- IBM Concert Software
- 6
- itsourcecode Sports Management System
- 5
- RemoteClinic
- 5
- TOTOLINK A702R
- 5
- Akınsoft QR Menü
- 4
- Sunnet eHRD CTMS
- 4
- Unisoc (Shanghai) Technologies Co. SC9863A/T310/T610/T618/T…
- 3
- Campcodes Courier Management System · SourceCodester Courie…
- 2
- Campcodes Online Hospital Management System
- 2
- Campcodes Online Learning Management System
- 2
Critical 6
- CVE-2024-28988SolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilitySolarWinds Web Help Desk
- CVE-2022-38696In BootRom, there's a possible missing payload size check.Unisoc (Shanghai) Technologies Co. SC9863A/T310/T610/T618/T…
- CVE-2022-38693In FDL1, there is a possible missing payload size check.Unisoc (Shanghai) Technologies Co. SC9863A//T310/T610/T618/…
- CVE-2022-38692In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation.Unisoc (Shanghai) Technologies Co. SC9863A/T310/T610/T618/T…
- CVE-2025-54857Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8Seiko Solutions SkyBridge BASIC MB-A130
- CVE-2025-6507Deserialization of Untrusted Data in h2oai/h2o-3h2oai/h2o-3
High 21
- CVE-2025-9791Tenda AC20 fromAdvSetMacMtuWan stack-based overflowTenda AC20
- CVE-2025-9809Out-of-bounds write in cdfs_open_cue_track in libretro libretro-common latest on all platforms allows remote attackers to execute arbitrary libretro-common
- CVE-2025-3586In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2Liferay Portal · Liferay DXP +1
- CVE-2025-57799StreamVault can perform remote command executionlemon8866 StreamVault
- CVE-2025-9783TOTOLINK A702R formParentControl sub_418030 buffer overflowTOTOLINK A702R
- CVE-2025-9782TOTOLINK A702R formOneKeyAccessButton sub_4466F8 buffer overflowTOTOLINK A702R
- CVE-2025-9781TOTOLINK A702R formFilter sub_4162DC buffer overflowTOTOLINK A702R
- CVE-2025-9780TOTOLINK A702R formIpQoS sub_419BE0 buffer overflowTOTOLINK A702R
- CVE-2025-2412OTP Bypass in Akinsoft's QR MenuAkinsoft QR Menu
- CVE-2025-0610CSRF in Akinsoft's QR MenuAkınsoft QR Menü
- CVE-2024-12925Host Header Injection in Akinsoft's QR MenuAkınsoft QR Menü
- CVE-2025-9779TOTOLINK A702R formFilter sub_4162DC buffer overflowTOTOLINK A702R
- CVE-2022-38695In BootRom, there's a possible unchecked command index.Unisoc (Shanghai) Technologies Co. SC9863A/T310/T610/T618/T…
- CVE-2022-38694In BootRom, there is a possible unchecked write address.Unisoc (Shanghai) Technologies Co. SC9863A//T310/T610/T618/
- CVE-2022-38691In BootROM, there is a possible missing validation for Certificate Type 0.Unisoc (Shanghai) Technologies Co. SC9863A//T310/T610/T618/
- CVE-2025-20706In mbrain, there is a possible memory corruption due to use after free.MediaTek MT6899, MT6989, MT6991, MT8676, MT8678
- CVE-2025-20705In monitor_hang, there is a possible memory corruption due to use after free.MediaTek MT2718, MT2735, MT6739, MT6761, MT6765, MT6768, MT…
- CVE-2025-20704In Modem, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6813, MT6835, MT6835T, MT6878, MT6878M, MT6897,…
- CVE-2025-20708In Modem, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT2735, MT2737, MT6813, MT6815, MT6833, MT6833P, M…
- CVE-2025-7731Information Disclosure Vulnerability in MELSEC iQ-F Series CPU moduleMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +73
- CVE-2025-7405Information Disclosure, Information Tampering, and Denial of Service (DoS) Vulnerability in MELSEC iQ-F Series CPU moduleMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +73
Medium, low and unrated 57
- CVE-2025-9802RemoteClinic profile.php sql injectionRemoteClinic
- CVE-2025-9801SimStudioAI sim path traversalSimStudioAI sim
- CVE-2025-9800SimStudioAI sim HTML File route.ts import unrestricted uploadSimStudioAI sim
- CVE-2025-9799Langfuse Webhook promptRouter.ts promptChangeEventSourcing server-side request forgeryLangfuse
- CVE-2025-9797mrvautin expressCart Edit Product edit injectionmrvautin expressCart
- CVE-2025-9796thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scriptingthinkgem JeeSite
- CVE-2025-9795xujeff tianti 天梯 UploadController.java ajaxUploadFile unrestricted uploadxujeff tianti 天梯
- CVE-2025-9794Campcodes Computer Sales and Inventory System pos_transac.php sql injectionCampcodes Computer Sales and Inventory System
- CVE-2025-9793itsourcecode Apartment Management System Setting admin.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9792itsourcecode Apartment Management System e_all_info.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9810TOCTOU race in Linenoise enables arbitrary file overwrite and permission changesantirez linenoise
- CVE-2025-9790SourceCodester Hotel Reservation System updateabout.php sql injectionSourceCodester Hotel Reservation System
- CVE-2025-9789SourceCodester Online Hotel Reservation System edituser.php sql injectionSourceCodester Online Hotel Reservation System
- CVE-2025-9788SourceCodester/Campcodes School Log Management System admin_class.php sql injectionSourceCodester School Log Management System · Campcodes Sch…
- CVE-2025-9375xmltodict 0.14.2 - XML Injectionxmltodict
- CVE-2025-55007Knowage vulnerable to server-side request forgeryKnowageLabs Knowage-Server
- CVE-2025-9786Campcodes Online Learning Management System teacher_signup.php sql injectionCampcodes Online Learning Management System
- CVE-2025-0656IBM Concert Software cross-site scriptingIBM Concert Software
- CVE-2025-33082IBM Concert Software cross-site scriptingIBM Concert Software
- CVE-2025-33083IBM Concert Software cross-site scriptingIBM Concert Software
- CVE-2025-33084IBM Concert Software information disclosureIBM Concert Software
- CVE-2025-33099IBM Concert Software information disclosureIBM Concert Software
- CVE-2025-33102IBM Concert Software information disclosureIBM Concert Software
- CVE-2024-12924Open Redirect in Akinsoft's QR MenuAkınsoft QR Menü
- CVE-2024-12914XSS in Akinsoft's QR MenuAkınsoft QR Menü
- CVE-2025-9778Tenda W12 Administrative shadow hard-coded credentialsTenda W12
- CVE-2025-36133IBM App Connect Enterprise information disclosureIBM App Connect Enterprise Certified Container
- CVE-2025-9775RemoteClinic edit-my-profile.php unrestricted uploadRemoteClinic
- CVE-2025-9774RemoteClinic edit-patient.php information disclosureRemoteClinic
- CVE-2025-9773RemoteClinic edit.php cross site scriptingRemoteClinic
- CVE-2025-9772RemoteClinic edit.php unrestricted uploadRemoteClinic
- CVE-2025-9771SourceCodester Eye Clinic Management System search_index_Diagnosis.php sql injectionSourceCodester Eye Clinic Management System
- CVE-2025-9770Campcodes Hospital Management System Admin Dashboard Login admin sql injectionCampcodes Hospital Management System
- CVE-2025-9769D-Link DI-7400G+ mng_platform.asp sub_478D28 command injectionD-Link DI-7400G+
- CVE-2025-9768itsourcecode Sports Management System mode.php sql injectionitsourcecode Sports Management System
- CVE-2025-58318DIAView - Authentication Bypass VulnerabilityDelta Electronics DIAView
- CVE-2025-9767itsourcecode Sports Management System sporttype.php sql injectionitsourcecode Sports Management System
- CVE-2025-9766itsourcecode Sports Management System facilitator.php sql injectionitsourcecode Sports Management System
- CVE-2025-9765itsourcecode Sports Management System tournament_details.php sql injectionitsourcecode Sports Management System
- CVE-2025-9764itsourcecode Sports Management System resultdetails.php sql injectionitsourcecode Sports Management System
- CVE-2025-20707In geniezone, there is a possible memory corruption due to use after free.MediaTek MT2718, MT6853, MT6877, MT6893, MT6899, MT6991, MT…
- CVE-2025-20703In Modem, there is a possible out of bounds read due to an incorrect bounds check.MediaTek MT2735, MT2737, MT6813, MT6833, MT6833P, MT6835, M…
- CVE-2025-9763Campcodes Online Learning Management System student_signup.php sql injectionCampcodes Online Learning Management System
- CVE-2025-9761Campcodes Online Feeds Product Inventory System Login index.php sql injectionCampcodes Online Feeds Product Inventory System
- CVE-2025-9760Portabilis i-Educar Matricula API matricula improper authorizationPortabilis i-Educar
- CVE-2025-9759Campcodes/SourceCodester Courier Management System ajax.php signup sql injectionCampcodes Courier Management System · SourceCodester Courie…
- CVE-2025-9758deepakmisal24 Chemical Inventory Management System inventory_form.php sql injectiondeepakmisal24 Chemical Inventory Management System
- CVE-2025-9570Sunnet｜eHRD CTMS - Arbitrary File Reading through Path TraversalSunnet eHRD CTMS
- CVE-2025-9569Sunnet｜eHRD CTMS - Reflected Cross-site ScriptingSunnet eHRD CTMS
- CVE-2025-9568Sunnet｜eHRD CTMS - Reflected Cross-site ScriptingSunnet eHRD CTMS
- CVE-2025-9567Sunnet｜eHRD CTMS - Reflected Cross-site ScriptingSunnet eHRD CTMS
- CVE-2025-9757Campcodes/SourceCodester Courier Management System ajax.php login sql injectionCampcodes Courier Management System · SourceCodester Courie…
- CVE-2025-9756PHPGurukul User Management System change-emailid.php sql injectionPHPGurukul User Management System
- CVE-2025-9755Khanakag-17 Library Management System index.php cross site scriptingKhanakag-17 Library Management System
- CVE-2025-9754Campcodes Online Hospital Management System Edit Profile edit-profile.php cross site scriptingCampcodes Online Hospital Management System
- CVE-2025-9753Campcodes Online Hospital Management System Patient Search patient-search.php cross site scriptingCampcodes Online Hospital Management System
- CVE-2025-9752D-Link DIR-852 SOAP Service soap.cgi soapcgi_main os command injectionD-Link DIR-852