CVEs published September 3, 2025
193 CVEs were published on September 3, 2025: 10 critical, 41 high. 1 is now in CISA KEV.
- Published
- 193
- Critical
- 10
- High
- 41
- Medium
- 135
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 42
Most affected products
- Samsung Mobile Devices
- 25
- Akinsoft MyRezzta
- 5
- projectworlds Travel Management System
- 5
- Akinsoft LimonDesk
- 4
- Mautic · mautic/core
- 4
- Sitecore Experience Manager · Sitecore Experience Platform
- 4
- Google Chrome
- 3
- Samsung Mobile S Assistant
- 3
- 1000projects Beauty Parlour Management System
- 2
- Apache Software Foundation Apache DolphinScheduler · org.ap…
- 2
Critical 10
- CVE-2025-55748XWiki Platform's configuration files can be accessed through jsx and sx endpointsxwiki-platform · org.xwiki.platform:xwiki-platform-skin-ski…
- CVE-2025-55747XWiki Platform's configuration files can be accessed through the webjars APIxwiki-platform · org.xwiki.platform:xwiki-platform-webja… +1
- CVE-2025-53690Sitecore Products ViewState Deserialization VulnerabilitySitecore Experience Manager · Sitecore Experience Platform
- CVE-2025-53693HTML Cache Poisoning through Unsafe ReflectionsSitecore Experience Manager · Sitecore Experience Platform
- CVE-2024-43166Incorrect Default Permissions vulnerability in Apache DolphinScheduler.Apache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2025-1740Authentication Bypass in Akinsoft's MyRezztaAkinsoft MyRezzta
- CVE-2024-32444WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerabilityInspiryThemes RealHomes
- CVE-2025-56752A vulnerability in the Ruijie RG-ES series switch firmware ESW_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanism
- CVE-2025-57052cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote at
- CVE-2025-57148phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension vali
High 41
- CVE-2025-58355Soft Serve is vulnerable to arbitrary file writing through its SSH APIcharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2025-9938D-Link DI-8400 yyxz.asp yyxz_dlink_asp stack-based overflowD-Link DI-8400
- CVE-2025-9365Fuji Electric FRENIC-Loader 4 Deserialization of Untrusted DataFuji Electric FRENIC-Loader
- CVE-2025-36193IBM Transformation Advisor incorrect permissionsIBM Transformation Advisor
- CVE-2025-9959Sandbox escape in smolagents Local Python execution environment via dunder attributessmolagents
- CVE-2025-9866Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security poliGoogle Chrome
- CVE-2025-0280HCL Compass is affected by a security vulnerabilityHCL Software Compass
- CVE-2025-58644WordPress LTL Freight Quotes - TQL Edition Plugin <= 1.2.6 - PHP Object Injection Vulnerabilityenituretechnology LTL Freight Quotes - TQL Edition
- CVE-2025-58643WordPress LTL Freight Quotes – Daylight Edition Plugin <= 2.2.7 - PHP Object Injection Vulnerabilityenituretechnology LTL Freight Quotes – Daylight Edition
- CVE-2025-58642WordPress LTL Freight Quotes – Day & Ross Edition Plugin <= 2.1.11 - PHP Object Injection Vulnerabilityenituretechnology LTL Freight Quotes – Day & Ross Edition
- CVE-2025-58637WordPress immonex Kickstart Plugin <= 1.11.6 - Local File Inclusion Vulnerabilityimmonex Kickstart
- CVE-2025-58608WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion VulnerabilityBuddyDev MediaPress
- CVE-2025-58604WordPress Mail Mint Plugin <= 1.18.5 - SQL Injection VulnerabilityWPFunnels Mail Mint
- CVE-2025-47421Privilege escalation via SCP loginCRESTRON TOUCHSCREENS x70
- CVE-2025-2416OTP Bypass in Akinsoft's LimonDeskAkinsoft LimonDesk
- CVE-2024-13068Host Header Injection in Akinsoft's LimonDeskAkinsoft LimonDesk
- CVE-2025-38678netfilter: nf_tables: reject duplicate device on updatesLinux
- CVE-2025-53691Sitecore Experience Remote Code Execution through Insecure DeserializationSitecore Experience Manager · Sitecore Experience Platform
- CVE-2025-53694Information Disclosure in ItemServices APISitecore Experience Manager · Sitecore Experience Platform
- CVE-2025-2415OTP Bypass in Akinsoft's MyRezztaAkinsoft MyRezzta
- CVE-2024-43115Apache DolphinScheduler: Alert Script AttackApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2014-125127Denial of Service (DoS) vulnerability in mikecao/flightflightphp core
- CVE-2025-9817NULL Pointer Dereference in WiresharkWireshark Foundation Wireshark
- CVE-2025-8663Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain CredentialsupKeeper Solutions upKeeper Manager
- CVE-2023-21480Improper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch privileged activities.Samsung Mobile Devices
- CVE-2023-21477Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to accSamsung Mobile Devices
- CVE-2023-21476Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrarSamsung Mobile Devices
- CVE-2023-21475Out-of-bounds Write vulnerability in libaudiosaplus_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrarSamsung Mobile Devices
- CVE-2025-9785Misconfigured certificate validation with self-signed certificates for Print DeployPaperCut Print Deploy
- CVE-2025-58176Dive's improper processing of custom urls can lead to Remote Code ExecutionOpenAgentPlatform Dive
- CVE-2025-58163FreeScout's deserialization of untrusted data can lead to Remote Code Executionfreescout-help-desk freescout
- CVE-2025-26210DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain.
- CVE-2025-45805In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile
- CVE-2025-52494Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes dur
- CVE-2025-55852Tenda AC8 v16.03.34.06 is vulnerable to Buffer Overflow in the formWifiBasicSet function via the parameter security or security_5g.
- CVE-2025-56803Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader.
- CVE-2025-57146phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter.
- CVE-2025-57147A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0.
- CVE-2025-57150phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName
- CVE-2025-57151phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter.
- CVE-2025-57833An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6.djangoproject Django · django
Medium, low and unrated 142
- CVE-2025-9937elunez eladmin LocalStorageController deleteFile improper authorizationelunez eladmin
- CVE-2025-9936fuyang_lipengjun platform queryAll AdController improper authorizationfuyang_lipengjun platform
- CVE-2025-9935TOTOLINK N600R cstecgi.cgi sub_4159F8 command injectionTOTOLINK N600R
- CVE-2025-9934TOTOLINK X5000R cstecgi.cgi sub_410C34 command injectionTOTOLINK X5000R
- CVE-2025-9933PHPGurukul Beauty Parlour Management System view-appointment.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-58064CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard packageckeditor5 · @ckeditor/ckeditor5-clipboard
- CVE-2025-9932PHPGurukul Beauty Parlour Management System update-image.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-9931Jinher OA POST Request login!changePassWord.action cross site scriptingJinher OA
- CVE-2025-58057Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attacknetty · io.netty:netty-codec-compression +1
- CVE-2025-99301000projects Beauty Parlour Management System contact-us.php sql injection1000projects Beauty Parlour Management System
- CVE-2025-9929code-projects Responsive Blog Site blogs_view.php cross site scriptingcode-projects Responsive Blog Site
- CVE-2025-9928projectworlds Travel Management System viewcategory.php sql injectionprojectworlds Travel Management System
- CVE-2025-58056Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensionsnetty · io.netty:netty-codec-http
- CVE-2025-9927projectworlds Travel Management System viewpackage.php sql injectionprojectworlds Travel Management System
- CVE-2025-8268Ai Engine <= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletiontigroumeow AI Engine – The Chatbot, AI Framework & MCP for…
- CVE-2025-9926projectworlds Travel Management System viewsubcategory.php sql injectionprojectworlds Travel Management System
- CVE-2025-55162Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flagenvoyproxy envoy
- CVE-2025-9925projectworlds Travel Management System detail.php sql injectionprojectworlds Travel Management System
- CVE-2025-9924projectworlds Travel Management System enquiry.php sql injectionprojectworlds Travel Management System
- CVE-2025-9923Campcodes Sales and Inventory System index.php cross site scriptingCampcodes Sales and Inventory System
- CVE-2025-20328A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privilegCisco Webex Meetings
- CVE-2025-20291A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user toCisco Webex Meetings
- CVE-2025-20335Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Arbitrary File Write VulnerabilityCisco Session Initiation Protocol (SIP) Software
- CVE-2025-20336Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Disclosure VulnerabilityCisco Session Initiation Protocol (SIP) Software
- CVE-2025-20330Cisco Unified Communications Manager IM and Presence Cross-Site Scripting VulnerabilityCisco Unified Communications Manager IM and Presence Service
- CVE-2025-20280Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting VulnerabilityCisco Evolved Programmable Network Manager · Cisco Prime In…
- CVE-2025-20326Cisco Unified Communications Manager Cross-Site Request Forgery VulnerabilityCisco Unified Communications Manager
- CVE-2025-20287Cisco Evolved Programmable Network Manager Arbitrary File Upload VulnerabilityCisco Evolved Programmable Network Manager
- CVE-2025-20270Cisco Evolved Programmable Network Manager Information Disclosure VulnerabilityCisco Evolved Programmable Network Manager · Cisco Prime In…
- CVE-2025-9922Campcodes Sales and Inventory System index.php cross site scriptingCampcodes Sales and Inventory System
- CVE-2025-9921code-projects POS Pharmacy System products.php cross site scriptingcode-projects POS Pharmacy System
- CVE-2025-9867Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofinGoogle Chrome
- CVE-2025-9865Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user toGoogle Chrome
- CVE-2025-9920Campcodes Recruitment Management System index.php include file inclusionCampcodes Recruitment Management System
- CVE-2025-99191000projects Beauty Parlour Management System bwdates-reports-details.php sql injection1000projects Beauty Parlour Management System
- CVE-2025-58460A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission Jenkins Project Jenkins OpenTelemetry Plugin · io.jenkins.p…
- CVE-2025-58459Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attaJenkins Project Jenkins global-build-stats Plugin · org.jen…
- CVE-2025-58458In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…
- CVE-2025-58641WordPress Exit Intent Popup Plugin <= 1.0.1 - Server Side Request Forgery (SSRF) Vulnerabilitykamleshyadav Exit Intent Popup
- CVE-2025-58640WordPress Document Engine Plugin <= 1.2 - Cross Site Scripting (XSS) VulnerabilityMatrixAddons Document Engine
- CVE-2025-58639WordPress Contact Form By Mega Forms Plugin <= 1.6.1 - Broken Access Control VulnerabilityAli Khallad Contact Form By Mega Forms
- CVE-2025-58635WordPress Support Genix Plugin <= 1.4.23 - Broken Access Control VulnerabilityDevItems Support Genix
- CVE-2025-58634WordPress PeachPay Payments Plugin <= 1.117.4 - Broken Access Control VulnerabilityPeachPay Payments
- CVE-2025-58633WordPress Booking Ultra Pro Plugin <= 1.1.21 - Cross Site Scripting (XSS) VulnerabilityDeetronix Booking Ultra Pro
- CVE-2025-58632WordPress Dadevarzan WordPress Common Plugin <= 2.2.2 - Cross Site Scripting (XSS) VulnerabilityDadevarzan WordPress Common
- CVE-2025-58631WordPress IssueM Plugin <= 2.9.0 - Cross Site Scripting (XSS) VulnerabilityZEEN101 IssueM
- CVE-2025-58630WordPress Simple Matomo Tracking Code Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerabilityrbaer Simple Matomo Tracking Code
- CVE-2025-58626WordPress RumbleTalk Live Group Chat Plugin <= 6.3.5 - Cross Site Scripting (XSS) VulnerabilityRumbleTalk Live Group Chat
- CVE-2025-58625WordPress WP Flow Plus Plugin <= 5.2.5 - Cross Site Scripting (XSS) VulnerabilitySpiffy Plugins WP Flow Plus
- CVE-2025-58624WordPress Exchange Rates Plugin <= 1.2.5 - Cross Site Scripting (XSS) Vulnerabilityfalselight Exchange Rates
- CVE-2025-58623WordPress Event Feed for Eventbrite Plugin <= 1.3.2 - Cross Site Scripting (XSS) VulnerabilityBohemia Plugins Event Feed for Eventbrite
- CVE-2025-58622WordPress Mobile Contact Line Plugin <= 2.4.0 - Broken Access Control Vulnerabilityyydevelopment Mobile Contact Line
- CVE-2025-58621WordPress PuzzleMe for WordPress Plugin <= 1.2.0 - Cross Site Scripting (XSS) VulnerabilityAmuse Labs PuzzleMe for WordPress
- CVE-2025-58620WordPress PDF for WPForms Plugin <= 6.2.1 - Cross Site Scripting (XSS) Vulnerabilityadd-ons.org PDF for WPForms
- CVE-2025-58618WordPress Pie Calendar Plugin <= 1.2.8 - Cross Site Scripting (XSS) VulnerabilityJonathan Jernigan Pie Calendar
- CVE-2025-58617WordPress F4 Media Taxonomies Plugin <= 1.1.4 - Broken Access Control VulnerabilityFAKTOR VIER F4 Media Taxonomies
- CVE-2025-58616WordPress Frisbii Pay Plugin <= 1.8.2.1 - Broken Access Control VulnerabilityFrisbii Pay
- CVE-2025-58615WordPress WP Bannerize Pro Plugin <= 1.10.0 - Server Side Request Forgery (SSRF) Vulnerabilitygfazioli WP Bannerize Pro
- CVE-2025-58614WordPress Tooltipy Plugin <= 5.5.6 - Cross Site Scripting (XSS) VulnerabilityJamel.Z Tooltipy
- CVE-2025-58613WordPress Posts Table with Search & Sort Plugin <= 1.4.10 - Broken Access Control VulnerabilityBarn2 Plugins Posts Table with Search & Sort
- CVE-2025-58612WordPress PropertyHive Plugin <= 2.1.5 - Cross Site Scripting (XSS) VulnerabilityProperty Hive PropertyHive
- CVE-2025-58611WordPress Tickera Plugin <= 3.5.5.6 - Cross Site Request Forgery (CSRF) VulnerabilityTickera
- CVE-2025-58610WordPress Gallery PhotoBlocks Plugin <= 1.3.1 - Cross Site Scripting (XSS) VulnerabilityWP Chill Gallery PhotoBlocks
- CVE-2025-58609WordPress Latest Post Shortcode Plugin <= 14.0.3 - Cross Site Scripting (XSS) VulnerabilityIulia Cazan Latest Post Shortcode
- CVE-2025-58607WordPress Cookie Notice & Consent Banner for GDPR & CCPA Compliance Plugin <= 1.7.11 - Cross Site Scripting (XSS) VulnerabilityGDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Co…
- CVE-2025-58606WordPress SaasLauncher Theme <= 1.3.0 - Broken Access Control Vulnerabilitycozythemes SaasLauncher
- CVE-2025-58605WordPress WP Delicious Plugin <= 1.8.7 - Cross Site Scripting (XSS) VulnerabilityWP Delicious
- CVE-2025-58603WordPress Surfer Plugin <= 1.6.4.574 - Broken Access Control VulnerabilitySurfer
- CVE-2025-58602WordPress If-So Dynamic Content Personalization Plugin <= 1.9.4 - Cross Site Scripting (XSS) VulnerabilityIf-So Dynamic Content Personalization
- CVE-2025-58601WordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control VulnerabilityRadiusTheme Classified Listing
- CVE-2025-58600WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control VulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2025-58599WordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerabilitytychesoftwares Order Delivery Date for WooCommerce
- CVE-2025-58598WordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure VulnerabilityKlarna Order Management for WooCommerce
- CVE-2025-58597WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) VulnerabilityTomdever wpForo Forum
- CVE-2025-58596WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerabilityproperfraction MailOptin
- CVE-2025-58594WordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerabilitythemefusecom Brizy
- CVE-2025-58593WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) VulnerabilityOrbit Fox by ThemeIsle
- CVE-2025-9823Reflected XSS in lead:addLeadTags - Quick AddMautic · mautic/core
- CVE-2025-9824User Enumeration via Response TimingMautic · mautic/core
- CVE-2025-9822Secret data extraction via elfinderMautic · mautic/core
- CVE-2025-0878XSS in Akinsoft's LimonDeskAkinsoft LimonDesk
- CVE-2024-13066iFrame Injection in Akinsoft's LimonDeskAkinsoft LimonDesk
- CVE-2025-3701WordPress Malcure Malware Scanner plugin <= 16.8 - Broken Access Control vulnerabilityMalcure Web Security Malcure Malware Scanner
- CVE-2025-9901Libsoup: improper handling of http vary header in libsoup cachingRed Hat Enterprise Linux
- CVE-2025-41000Cross-Frame Scripting (XFS) in BoomCMSBoomCMS
- CVE-2025-9821SSRF via webhook functionMautic · mautic/core
- CVE-2024-13065Business Logic Error in Akinsoft's MyRezztaAkinsoft MyRezzta
- CVE-2024-13064XSS in Akinsoft's MyRezztaAkinsoft MyRezzta
- CVE-2024-13063IDOR in Akinsoft's MyRezztaAkinsoft MyRezzta
- CVE-2025-9219Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Updatesaadiqbal Post SMTP – Complete Email Deliverability and SMT…
- CVE-2025-58210WordPress Makeaholic Theme <= 1.8.5 - Broken Access Control VulnerabilityThemeMove Makeaholic
- CVE-2025-9378Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributesthemehunk Vayu Blocks – Website Builder for the Block Editor
- CVE-2025-21041Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information.Samsung Mobile Secure Folder
- CVE-2025-21040Improper verification of intent by ExternalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerarSamsung Mobile S Assistant
- CVE-2025-21039Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modifySamsung Mobile S Assistant
- CVE-2025-21038Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modifSamsung Mobile S Assistant
- CVE-2025-21037Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles.Samsung Mobile SamsungNotes
- CVE-2025-21036Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files.Samsung Mobile Samsung Notes
- CVE-2025-21035Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers Samsung Mobile Samsung Calendar
- CVE-2025-21034Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code.Samsung Mobile Devices
- CVE-2025-21033Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information.Samsung Mobile Devices
- CVE-2025-21032Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditioSamsung Mobile Devices
- CVE-2025-21031Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs.Samsung Mobile Devices
- CVE-2025-21030Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows locaSamsung Mobile Devices
- CVE-2025-21029Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies tSamsung Mobile Devices
- CVE-2025-21028Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items.Samsung Mobile Devices
- CVE-2025-21027Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily diSamsung Mobile Devices
- CVE-2025-21026Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call.Samsung Mobile Devices
- CVE-2025-21025Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background executSamsung Mobile Devices
- CVE-2023-21474Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privilSamsung Mobile Devices
- CVE-2023-3666Sticky Side Buttons < 2.0.0 - Admin+ Stored XSSSticky Side Buttons
- CVE-2025-58272Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier.NTT EAST Web Caster · NTT WEST Web Caster
- CVE-2023-21483Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protected data using exporteSamsung Mobile Galaxy Store
- CVE-2023-21482Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 1Samsung Mobile Samsung Camera
- CVE-2023-21481Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitivSamsung Mobile Samsung Account
- CVE-2023-21479Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackersSamsung Mobile Devices
- CVE-2023-21478Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data.Samsung Mobile Devices
- CVE-2023-21473Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrarySamsung Mobile Devices
- CVE-2023-21472Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrarySamsung Mobile Devices
- CVE-2023-21471Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system pSamsung Mobile Devices
- CVE-2023-21470Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location informationSamsung Mobile Devices
- CVE-2023-21469Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location informationSamsung Mobile Devices
- CVE-2023-21468Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permissioSamsung Mobile Devices
- CVE-2023-21467Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted messaSamsung Mobile Devices
- CVE-2023-21466PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access conSamsung Mobile Devices
- CVE-2025-58351Outline's Local File Storage Feature can Cause CSP Bypassoutline
- CVE-2025-7039Glib: buffer under-read on glib through glib/gfileutils.c via get_tmp_file()Red Hat Enterprise Linux
- CVE-2025-9848ScriptAndTools Real Estate Management System userlist.php redirectScriptAndTools Real Estate Management System
- CVE-2025-9847ScriptAndTools Real Estate Management System register.php unrestricted uploadScriptAndTools Real Estate Management System
- CVE-2025-57806Local Deep Research's API keys are stored in plain textLearningCircuit local-deep-research
- CVE-2025-9845code-projects Fruit Shop Management System products.php cross site scriptingcode-projects Fruit Shop Management System
- CVE-2025-9843Das Parking Management System 停车场管理系统 FindAll information disclosureDas Parking Management System 停车场管理系统
- CVE-2025-9842Das Parking Management System 停车场管理系统 Search information disclosureDas Parking Management System 停车场管理系统
- CVE-2025-55944Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads.
- CVE-2025-56139LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user rep
- CVE-2025-56435SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the.
- CVE-2025-56498An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface.
- CVE-2025-56608The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`
- CVE-2025-56689One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authenti
- CVE-2025-56760When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path travgithub.com/usememos/memos
- CVE-2025-56761Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features.github.com/usememos/memos
- CVE-2025-57149phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter.