# CVEs published 2025-09-03

193 CVEs were published on September 3, 2025: 10 critical, 41 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-58355](https://cve.now/CVE-2025-58355.md): Soft Serve is vulnerable to arbitrary file writing through its SSH API (CVSS 7.7, charmbracelet soft-serve · github.com/charmbracelet/soft-se…)
- [CVE-2025-9938](https://cve.now/CVE-2025-9938.md): D-Link DI-8400 yyxz.asp yyxz\_dlink\_asp stack-based overflow (CVSS 8.7, D-Link DI-8400)
- [CVE-2025-9937](https://cve.now/CVE-2025-9937.md): elunez eladmin LocalStorageController deleteFile improper authorization (CVSS 5.3, elunez eladmin)
- [CVE-2025-9936](https://cve.now/CVE-2025-9936.md): fuyang\_lipengjun platform queryAll AdController improper authorization (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-9935](https://cve.now/CVE-2025-9935.md): TOTOLINK N600R cstecgi.cgi sub\_4159F8 command injection (CVSS 6.9, TOTOLINK N600R)
- [CVE-2025-9934](https://cve.now/CVE-2025-9934.md): TOTOLINK X5000R cstecgi.cgi sub\_410C34 command injection (CVSS 5.3, TOTOLINK X5000R)
- [CVE-2025-9933](https://cve.now/CVE-2025-9933.md): PHPGurukul Beauty Parlour Management System view-appointment.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-58064](https://cve.now/CVE-2025-58064.md): CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package (CVSS 2.3, ckeditor5 · @ckeditor/ckeditor5-clipboard)
- [CVE-2025-9932](https://cve.now/CVE-2025-9932.md): PHPGurukul Beauty Parlour Management System update-image.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-9931](https://cve.now/CVE-2025-9931.md): Jinher OA POST Request login!changePassWord.action cross site scripting (CVSS 5.3, Jinher OA)
- [CVE-2025-58057](https://cve.now/CVE-2025-58057.md): Netty's BrotliDecoder is vulnerable to DoS via zip bomb style attack (CVSS 6.9, netty · io.netty:netty-codec-compression +1)
- [CVE-2025-9930](https://cve.now/CVE-2025-9930.md): 1000projects Beauty Parlour Management System contact-us.php sql injection (CVSS 6.9, 1000projects Beauty Parlour Management System)
- [CVE-2025-9929](https://cve.now/CVE-2025-9929.md): code-projects Responsive Blog Site blogs\_view.php cross site scripting (CVSS 4.8, code-projects Responsive Blog Site)
- [CVE-2025-9928](https://cve.now/CVE-2025-9928.md): projectworlds Travel Management System viewcategory.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-58056](https://cve.now/CVE-2025-58056.md): Netty is vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVSS 2.9, netty · io.netty:netty-codec-http)
- [CVE-2025-9927](https://cve.now/CVE-2025-9927.md): projectworlds Travel Management System viewpackage.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-8268](https://cve.now/CVE-2025-8268.md): Ai Engine \<= 2.9.5 - Missing Authorization to Unauthenticated Uploaded Files Disclosure And Deletion (CVSS 6.5, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2025-55748](https://cve.now/CVE-2025-55748.md): XWiki Platform's configuration files can be accessed through jsx and sx endpoints (CVSS 9.3, xwiki-platform · org.xwiki.platform:xwiki-platform-skin-ski…)
- [CVE-2025-55747](https://cve.now/CVE-2025-55747.md): XWiki Platform's configuration files can be accessed through the webjars API (CVSS 9.3, xwiki-platform · org.xwiki.platform:xwiki-platform-webja… +1)
- [CVE-2025-53690](https://cve.now/CVE-2025-53690.md): Sitecore Products ViewState Deserialization Vulnerability (CVSS 9.0, KEV, Sitecore Experience Manager · Sitecore Experience Platform)
- [CVE-2025-9926](https://cve.now/CVE-2025-9926.md): projectworlds Travel Management System viewsubcategory.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-55162](https://cve.now/CVE-2025-55162.md): Envoy: oAuth2 Filter Signout route will not clear cookies because of missing "secure;" flag (CVSS 6.3, envoyproxy envoy)
- [CVE-2025-9365](https://cve.now/CVE-2025-9365.md): Fuji Electric FRENIC-Loader 4 Deserialization of Untrusted Data (CVSS 8.4, Fuji Electric FRENIC-Loader)
- [CVE-2025-9925](https://cve.now/CVE-2025-9925.md): projectworlds Travel Management System detail.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-36193](https://cve.now/CVE-2025-36193.md): IBM Transformation Advisor incorrect permissions (CVSS 8.4, IBM Transformation Advisor)
- [CVE-2025-9924](https://cve.now/CVE-2025-9924.md): projectworlds Travel Management System enquiry.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-9923](https://cve.now/CVE-2025-9923.md): Campcodes Sales and Inventory System index.php cross site scripting (CVSS 5.3, Campcodes Sales and Inventory System)
- [CVE-2025-20328](https://cve.now/CVE-2025-20328.md): A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileg (CVSS 5.4, Cisco Webex Meetings)
- [CVE-2025-20291](https://cve.now/CVE-2025-20291.md): A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user to (CVSS 4.3, Cisco Webex Meetings)
- [CVE-2025-20335](https://cve.now/CVE-2025-20335.md): Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Arbitrary File Write Vulnerability (CVSS 5.3, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2025-20336](https://cve.now/CVE-2025-20336.md): Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Firmware Information Disclosure Vulnerability (CVSS 5.3, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2025-20330](https://cve.now/CVE-2025-20330.md): Cisco Unified Communications Manager IM and Presence Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Unified Communications Manager IM and Presence Service)
- [CVE-2025-20280](https://cve.now/CVE-2025-20280.md): Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Stored Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco Evolved Programmable Network Manager · Cisco Prime In…)
- [CVE-2025-20326](https://cve.now/CVE-2025-20326.md): Cisco Unified Communications Manager Cross-Site Request Forgery Vulnerability (CVSS 4.3, Cisco Unified Communications Manager)
- [CVE-2025-20287](https://cve.now/CVE-2025-20287.md): Cisco Evolved Programmable Network Manager Arbitrary File Upload Vulnerability (CVSS 4.3, Cisco Evolved Programmable Network Manager)
- [CVE-2025-20270](https://cve.now/CVE-2025-20270.md): Cisco Evolved Programmable Network Manager Information Disclosure Vulnerability (CVSS 4.3, Cisco Evolved Programmable Network Manager · Cisco Prime In…)
- [CVE-2025-9922](https://cve.now/CVE-2025-9922.md): Campcodes Sales and Inventory System index.php cross site scripting (CVSS 5.3, Campcodes Sales and Inventory System)
- [CVE-2025-9921](https://cve.now/CVE-2025-9921.md): code-projects POS Pharmacy System products.php cross site scripting (CVSS 4.8, code-projects POS Pharmacy System)
- [CVE-2025-9959](https://cve.now/CVE-2025-9959.md): Sandbox escape in smolagents Local Python execution environment via dunder attributes (CVSS 7.6, smolagents)
- [CVE-2025-9867](https://cve.now/CVE-2025-9867.md): Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofin (CVSS 5.4, Google Chrome)
- [CVE-2025-9866](https://cve.now/CVE-2025-9866.md): Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security poli (CVSS 8.8, Google Chrome)
- [CVE-2025-9865](https://cve.now/CVE-2025-9865.md): Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to (CVSS 5.4, Google Chrome)
- [CVE-2025-9920](https://cve.now/CVE-2025-9920.md): Campcodes Recruitment Management System index.php include file inclusion (CVSS 5.1, Campcodes Recruitment Management System)
- [CVE-2025-9919](https://cve.now/CVE-2025-9919.md): 1000projects Beauty Parlour Management System bwdates-reports-details.php sql injection (CVSS 6.9, 1000projects Beauty Parlour Management System)
- [CVE-2025-0280](https://cve.now/CVE-2025-0280.md): HCL Compass is affected by a security vulnerability (CVSS 7.5, HCL Software Compass)
- [CVE-2025-58460](https://cve.now/CVE-2025-58460.md): A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b\_92b\_cd64 and earlier allows attackers with Overall/Read permission (CVSS 4.2, Jenkins Project Jenkins OpenTelemetry Plugin · io.jenkins.p…)
- [CVE-2025-58459](https://cve.now/CVE-2025-58459.md): Jenkins global-build-stats Plugin 322.v22f4db\_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing atta (CVSS 4.3, Jenkins Project Jenkins global-build-stats Plugin · org.jen…)
- [CVE-2025-58458](https://cve.now/CVE-2025-58458.md): In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the (CVSS 4.3, Jenkins Project Jenkins Git client Plugin · org.jenkins-ci.…)
- [CVE-2025-58644](https://cve.now/CVE-2025-58644.md): WordPress LTL Freight Quotes - TQL Edition Plugin \<= 1.2.6 - PHP Object Injection Vulnerability (CVSS 7.2, enituretechnology LTL Freight Quotes - TQL Edition)
- [CVE-2025-58643](https://cve.now/CVE-2025-58643.md): WordPress LTL Freight Quotes – Daylight Edition Plugin \<= 2.2.7 - PHP Object Injection Vulnerability (CVSS 7.2, enituretechnology LTL Freight Quotes – Daylight Edition)
- [CVE-2025-58642](https://cve.now/CVE-2025-58642.md): WordPress LTL Freight Quotes – Day & Ross Edition Plugin \<= 2.1.11 - PHP Object Injection Vulnerability (CVSS 7.2, enituretechnology LTL Freight Quotes – Day & Ross Edition)
- [CVE-2025-58641](https://cve.now/CVE-2025-58641.md): WordPress Exit Intent Popup Plugin \<= 1.0.1 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 5.4, kamleshyadav Exit Intent Popup)
- [CVE-2025-58640](https://cve.now/CVE-2025-58640.md): WordPress Document Engine Plugin \<= 1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, MatrixAddons Document Engine)
- [CVE-2025-58639](https://cve.now/CVE-2025-58639.md): WordPress Contact Form By Mega Forms Plugin \<= 1.6.1 - Broken Access Control Vulnerability (CVSS 5.4, Ali Khallad Contact Form By Mega Forms)
- [CVE-2025-58637](https://cve.now/CVE-2025-58637.md): WordPress immonex Kickstart Plugin \<= 1.11.6 - Local File Inclusion Vulnerability (CVSS 7.5, immonex Kickstart)
- [CVE-2025-58635](https://cve.now/CVE-2025-58635.md): WordPress Support Genix Plugin \<= 1.4.23 - Broken Access Control Vulnerability (CVSS 5.3, DevItems Support Genix)
- [CVE-2025-58634](https://cve.now/CVE-2025-58634.md): WordPress PeachPay Payments Plugin \<= 1.117.4 - Broken Access Control Vulnerability (CVSS 5.3, PeachPay Payments)
- [CVE-2025-58633](https://cve.now/CVE-2025-58633.md): WordPress Booking Ultra Pro Plugin \<= 1.1.21 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Deetronix Booking Ultra Pro)
- [CVE-2025-58632](https://cve.now/CVE-2025-58632.md): WordPress Dadevarzan WordPress Common Plugin \<= 2.2.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Dadevarzan WordPress Common)
- [CVE-2025-58631](https://cve.now/CVE-2025-58631.md): WordPress IssueM Plugin \<= 2.9.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, ZEEN101 IssueM)
- [CVE-2025-58630](https://cve.now/CVE-2025-58630.md): WordPress Simple Matomo Tracking Code Plugin \<= 1.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, rbaer Simple Matomo Tracking Code)
- [CVE-2025-58626](https://cve.now/CVE-2025-58626.md): WordPress RumbleTalk Live Group Chat Plugin \<= 6.3.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, RumbleTalk Live Group Chat)
- [CVE-2025-58625](https://cve.now/CVE-2025-58625.md): WordPress WP Flow Plus Plugin \<= 5.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Spiffy Plugins WP Flow Plus)
- [CVE-2025-58624](https://cve.now/CVE-2025-58624.md): WordPress Exchange Rates Plugin \<= 1.2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, falselight Exchange Rates)
- [CVE-2025-58623](https://cve.now/CVE-2025-58623.md): WordPress Event Feed for Eventbrite Plugin \<= 1.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Bohemia Plugins Event Feed for Eventbrite)
- [CVE-2025-58622](https://cve.now/CVE-2025-58622.md): WordPress Mobile Contact Line Plugin \<= 2.4.0 - Broken Access Control Vulnerability (CVSS 4.3, yydevelopment Mobile Contact Line)
- [CVE-2025-58621](https://cve.now/CVE-2025-58621.md): WordPress PuzzleMe for WordPress Plugin \<= 1.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Amuse Labs PuzzleMe for WordPress)
- [CVE-2025-58620](https://cve.now/CVE-2025-58620.md): WordPress PDF for WPForms Plugin \<= 6.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, add-ons.org PDF for WPForms)
- [CVE-2025-58618](https://cve.now/CVE-2025-58618.md): WordPress Pie Calendar Plugin \<= 1.2.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Jonathan Jernigan Pie Calendar)
- [CVE-2025-58617](https://cve.now/CVE-2025-58617.md): WordPress F4 Media Taxonomies Plugin \<= 1.1.4 - Broken Access Control Vulnerability (CVSS 4.3, FAKTOR VIER F4 Media Taxonomies)
- [CVE-2025-58616](https://cve.now/CVE-2025-58616.md): WordPress Frisbii Pay Plugin \<= 1.8.2.1 - Broken Access Control Vulnerability (CVSS 6.5, Frisbii Pay)
- [CVE-2025-58615](https://cve.now/CVE-2025-58615.md): WordPress WP Bannerize Pro Plugin \<= 1.10.0 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.4, gfazioli WP Bannerize Pro)
- [CVE-2025-58614](https://cve.now/CVE-2025-58614.md): WordPress Tooltipy Plugin \<= 5.5.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Jamel.Z Tooltipy)
- [CVE-2025-58613](https://cve.now/CVE-2025-58613.md): WordPress Posts Table with Search & Sort Plugin \<= 1.4.10 - Broken Access Control Vulnerability (CVSS 5.3, Barn2 Plugins Posts Table with Search & Sort)
- [CVE-2025-58612](https://cve.now/CVE-2025-58612.md): WordPress PropertyHive Plugin \<= 2.1.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Property Hive PropertyHive)
- [CVE-2025-58611](https://cve.now/CVE-2025-58611.md): WordPress Tickera Plugin \<= 3.5.5.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Tickera)
- [CVE-2025-58610](https://cve.now/CVE-2025-58610.md): WordPress Gallery PhotoBlocks Plugin \<= 1.3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Chill Gallery PhotoBlocks)
- [CVE-2025-58609](https://cve.now/CVE-2025-58609.md): WordPress Latest Post Shortcode Plugin \<= 14.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Iulia Cazan Latest Post Shortcode)
- [CVE-2025-58608](https://cve.now/CVE-2025-58608.md): WordPress MediaPress Plugin \<= 1.5.9.1 - Local File Inclusion Vulnerability (CVSS 7.5, BuddyDev MediaPress)
- [CVE-2025-58607](https://cve.now/CVE-2025-58607.md): WordPress Cookie Notice & Consent Banner for GDPR & CCPA Compliance Plugin \<= 1.7.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Co…)
- [CVE-2025-58606](https://cve.now/CVE-2025-58606.md): WordPress SaasLauncher Theme \<= 1.3.0 - Broken Access Control Vulnerability (CVSS 5.0, cozythemes SaasLauncher)
- [CVE-2025-58605](https://cve.now/CVE-2025-58605.md): WordPress WP Delicious Plugin \<= 1.8.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Delicious)
- [CVE-2025-58604](https://cve.now/CVE-2025-58604.md): WordPress Mail Mint Plugin \<= 1.18.5 - SQL Injection Vulnerability (CVSS 7.6, WPFunnels Mail Mint)
- [CVE-2025-58603](https://cve.now/CVE-2025-58603.md): WordPress Surfer Plugin \<= 1.6.4.574 - Broken Access Control Vulnerability (CVSS 5.3, Surfer)
- [CVE-2025-58602](https://cve.now/CVE-2025-58602.md): WordPress If-So Dynamic Content Personalization Plugin \<= 1.9.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, If-So Dynamic Content Personalization)
- [CVE-2025-58601](https://cve.now/CVE-2025-58601.md): WordPress Classified Listing Plugin \<= 5.0.6 - Broken Access Control Vulnerability (CVSS 4.3, RadiusTheme Classified Listing)
- [CVE-2025-58600](https://cve.now/CVE-2025-58600.md): WordPress Paid Member Subscriptions Plugin \<= 2.15.9 - Broken Access Control Vulnerability (CVSS 5.3, Cozmoslabs Paid Member Subscriptions)
- [CVE-2025-58599](https://cve.now/CVE-2025-58599.md): WordPress Order Delivery Date for WooCommerce Plugin \<= 4.1.0 - Broken Access Control Vulnerability (CVSS 4.3, tychesoftwares Order Delivery Date for WooCommerce)
- [CVE-2025-58598](https://cve.now/CVE-2025-58598.md): WordPress Klarna Order Management for WooCommerce Plugin \<= 1.9.8 - Sensitive Data Exposure Vulnerability (CVSS 6.6, Klarna Order Management for WooCommerce)
- [CVE-2025-58597](https://cve.now/CVE-2025-58597.md): WordPress wpForo Forum Plugin \<= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 4.3, Tomdever wpForo Forum)
- [CVE-2025-58596](https://cve.now/CVE-2025-58596.md): WordPress MailOptin Plugin \<= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, properfraction MailOptin)
- [CVE-2025-58594](https://cve.now/CVE-2025-58594.md): WordPress Brizy Plugin \<= 2.7.12 - Broken Access Control Vulnerability (CVSS 4.3, themefusecom Brizy)
- [CVE-2025-58593](https://cve.now/CVE-2025-58593.md): WordPress Orbit Fox by ThemeIsle Plugin \<= 3.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Orbit Fox by ThemeIsle)
- [CVE-2025-9823](https://cve.now/CVE-2025-9823.md): Reflected XSS in lead:addLeadTags - Quick Add (CVSS 4.8, Mautic · mautic/core)
- [CVE-2025-9824](https://cve.now/CVE-2025-9824.md): User Enumeration via Response Timing (CVSS 5.9, Mautic · mautic/core)
- [CVE-2025-9822](https://cve.now/CVE-2025-9822.md): Secret data extraction via elfinder (CVSS 5.5, Mautic · mautic/core)
- [CVE-2025-47421](https://cve.now/CVE-2025-47421.md): Privilege escalation via SCP login (CVSS 8.6, CRESTRON TOUCHSCREENS x70)
- [CVE-2025-2416](https://cve.now/CVE-2025-2416.md): OTP Bypass in Akinsoft's LimonDesk (CVSS 8.6, Akinsoft LimonDesk)
- [CVE-2025-0878](https://cve.now/CVE-2025-0878.md): XSS in Akinsoft's LimonDesk (CVSS 4.7, Akinsoft LimonDesk)
- [CVE-2024-13068](https://cve.now/CVE-2024-13068.md): Host Header Injection in Akinsoft's LimonDesk (CVSS 7.3, Akinsoft LimonDesk)
- [CVE-2024-13066](https://cve.now/CVE-2024-13066.md): iFrame Injection in Akinsoft's LimonDesk (CVSS 4.3, Akinsoft LimonDesk)
- [CVE-2025-38678](https://cve.now/CVE-2025-38678.md): netfilter: nf\_tables: reject duplicate device on updates (CVSS 7.8, Linux)
- [CVE-2025-3701](https://cve.now/CVE-2025-3701.md): WordPress Malcure Malware Scanner plugin \<= 16.8 - Broken Access Control vulnerability (CVSS 4.3, Malcure Web Security Malcure Malware Scanner)
- [CVE-2025-53691](https://cve.now/CVE-2025-53691.md): Sitecore Experience Remote Code Execution through Insecure Deserialization (CVSS 8.8, Sitecore Experience Manager · Sitecore Experience Platform)
- [CVE-2025-53693](https://cve.now/CVE-2025-53693.md): HTML Cache Poisoning through Unsafe Reflections (CVSS 9.8, Sitecore Experience Manager · Sitecore Experience Platform)
- [CVE-2025-53694](https://cve.now/CVE-2025-53694.md): Information Disclosure in ItemServices API (CVSS 7.5, Sitecore Experience Manager · Sitecore Experience Platform)
- [CVE-2025-9901](https://cve.now/CVE-2025-9901.md): Libsoup: improper handling of http vary header in libsoup caching (CVSS 5.9, Red Hat Enterprise Linux)
- [CVE-2025-41000](https://cve.now/CVE-2025-41000.md): Cross-Frame Scripting (XFS) in BoomCMS (CVSS 2.1, BoomCMS)
- [CVE-2025-9821](https://cve.now/CVE-2025-9821.md): SSRF via webhook function (CVSS 2.7, Mautic · mautic/core)
- [CVE-2024-43166](https://cve.now/CVE-2024-43166.md): Incorrect Default Permissions vulnerability in Apache DolphinScheduler. (CVSS 9.8, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2025-2415](https://cve.now/CVE-2025-2415.md): OTP Bypass in Akinsoft's MyRezzta (CVSS 8.6, Akinsoft MyRezzta)
- [CVE-2025-1740](https://cve.now/CVE-2025-1740.md): Authentication Bypass in Akinsoft's MyRezzta (CVSS 9.8, Akinsoft MyRezzta)
- [CVE-2024-13065](https://cve.now/CVE-2024-13065.md): Business Logic Error in Akinsoft's MyRezzta (CVSS 6.3, Akinsoft MyRezzta)
- [CVE-2024-13064](https://cve.now/CVE-2024-13064.md): XSS in Akinsoft's MyRezzta (CVSS 4.3, Akinsoft MyRezzta)
- [CVE-2024-43115](https://cve.now/CVE-2024-43115.md): Apache DolphinScheduler: Alert Script Attack (CVSS 8.8, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2014-125127](https://cve.now/CVE-2014-125127.md): Denial of Service (DoS) vulnerability in mikecao/flight (CVSS 7.5, flightphp core)
- [CVE-2024-13063](https://cve.now/CVE-2024-13063.md): IDOR in Akinsoft's MyRezzta (CVSS 6.8, Akinsoft MyRezzta)
- [CVE-2025-9219](https://cve.now/CVE-2025-9219.md): Post SMTP \<= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update (CVSS 4.3, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2025-9817](https://cve.now/CVE-2025-9817.md): NULL Pointer Dereference in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2025-8663](https://cve.now/CVE-2025-8663.md): Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials (CVSS 8.8, upKeeper Solutions upKeeper Manager)
- [CVE-2025-58210](https://cve.now/CVE-2025-58210.md): WordPress Makeaholic Theme \<= 1.8.5 - Broken Access Control Vulnerability (CVSS 5.3, ThemeMove Makeaholic)
- [CVE-2024-32444](https://cve.now/CVE-2024-32444.md): WordPress RealHomes theme \<= 4.3.6 - Privilege Escalation vulnerability (CVSS 9.8, InspiryThemes RealHomes)
- [CVE-2025-9378](https://cve.now/CVE-2025-9378.md): Vayu Blocks \<= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes (CVSS 6.4, themehunk Vayu Blocks – Website Builder for the Block Editor)
- [CVE-2025-21041](https://cve.now/CVE-2025-21041.md): Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensitive information. (CVSS 6.2, Samsung Mobile Secure Folder)
- [CVE-2025-21040](https://cve.now/CVE-2025-21040.md): Improper verification of intent by ExternalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify itinerar (CVSS 5.1, Samsung Mobile S Assistant)
- [CVE-2025-21039](https://cve.now/CVE-2025-21039.md): Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modify (CVSS 5.1, Samsung Mobile S Assistant)
- [CVE-2025-21038](https://cve.now/CVE-2025-21038.md): Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attackers to modif (CVSS 5.1, Samsung Mobile S Assistant)
- [CVE-2025-21037](https://cve.now/CVE-2025-21037.md): Improper access control in Samsung Notes prior to version 4.4.30.63 allows physical attackers to access data across multiple user profiles. (CVSS 4.1, Samsung Mobile SamsungNotes)
- [CVE-2025-21036](https://cve.now/CVE-2025-21036.md): Improper access control in Samsung Notes prior to version 4.4.30.63 allows local privileged attackers to access exported note files. (CVSS 5.0, Samsung Mobile Samsung Notes)
- [CVE-2025-21035](https://cve.now/CVE-2025-21035.md): Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers (CVSS 4.6, Samsung Mobile Samsung Calendar)
- [CVE-2025-21034](https://cve.now/CVE-2025-21034.md): Out-of-bounds write in libsavsvc.so prior to SMR Sep-2025 Release 1 allows local attackers to potentially execute arbitrary code. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21033](https://cve.now/CVE-2025-21033.md): Improper access control in ContactProvider prior to SMR Sep-2025 Release 1 allows local attackers to access sensitive information. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21032](https://cve.now/CVE-2025-21032.md): Improper access control in One UI Home prior to SMR Sep-2025 Release 1 allows physical attackers to bypass Kiosk mode under limited conditio (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2025-21031](https://cve.now/CVE-2025-21031.md): Improper access control in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to use the privileged APIs. (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2025-21030](https://cve.now/CVE-2025-21030.md): Improper handling of insufficient permission in AppPrelaunchManagerService prior to SMR Sep-2025 Release 1 in Chinese Android 15 allows loca (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2025-21029](https://cve.now/CVE-2025-21029.md): Improper handling of insufficient permission in System UI prior to SMR Sep-2025 Release 1 allows local attackers to send arbitrary replies t (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21028](https://cve.now/CVE-2025-21028.md): Improper privilege management in ThemeManager prior to SMR Sep-2025 Release 1 allows local privileged attackers to reuse trial items. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-21027](https://cve.now/CVE-2025-21027.md): Improper verification of intent by broadcast receiver in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to temporarily di (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2025-21026](https://cve.now/CVE-2025-21026.md): Improper handling of insufficient permission in ImsService prior to SMR Sep-2025 Release 1 allows local attackers to interrupt the call. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21025](https://cve.now/CVE-2025-21025.md): Improper access control in MARsExemptionManager prior to SMR Sep-2025 Release 1 allows local attackers to be excluded from background execut (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2023-21474](https://cve.now/CVE-2023-21474.md): Intent redirection vulnerability in SecSettings prior to SMR Apr-2022 Release 1 allows attackers to access arbitrary file with system privil (CVSS 6.3, Samsung Mobile Devices)
- [CVE-2023-3666](https://cve.now/CVE-2023-3666.md): Sticky Side Buttons \< 2.0.0 - Admin+ Stored XSS (CVSS 3.3, Sticky Side Buttons)
- [CVE-2025-58272](https://cve.now/CVE-2025-58272.md): Cross-site request forgery vulnerability exists in Web Caster V130 versions 1.08 and earlier. (CVSS 3.7, NTT EAST Web Caster · NTT WEST Web Caster)
- [CVE-2023-21483](https://cve.now/CVE-2023-21483.md): Improper Access Control vulnerability in Galaxy Store prior to version 4.5.53.6 allows local attacker to access protected data using exporte (CVSS 6.4, Samsung Mobile Galaxy Store)
- [CVE-2023-21482](https://cve.now/CVE-2023-21482.md): Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 1 (CVSS 6.1, Samsung Mobile Samsung Camera)
- [CVE-2023-21481](https://cve.now/CVE-2023-21481.md): Improper URL input validation vulnerability in Samsung Account application prior to version 14.1.0.0 allows remote attackers to get sensitiv (CVSS 5.4, Samsung Mobile Samsung Account)
- [CVE-2023-21480](https://cve.now/CVE-2023-21480.md): Improper input validation vulnerability in CertByte prior to SMR Apr-2023 Release 1 allows local attackers to launch privileged activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2023-21479](https://cve.now/CVE-2023-21479.md): Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2023-21478](https://cve.now/CVE-2023-21478.md): Improper input validation vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to access protected data. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2023-21477](https://cve.now/CVE-2023-21477.md): Access of Memory Location After End of Buffer vulnerability in TIGERF trustlet prior to SMR Apr-2023 Release 1 allows local attackers to acc (CVSS 7.9, Samsung Mobile Devices)
- [CVE-2023-21476](https://cve.now/CVE-2023-21476.md): Out-of-bounds Write vulnerability in libaudiosaplus\_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrar (CVSS 8.0, Samsung Mobile Devices)
- [CVE-2023-21475](https://cve.now/CVE-2023-21475.md): Out-of-bounds Write vulnerability in libaudiosaplus\_sec.so library prior to SMR Apr-2023 Release 1 allows local attacker to execute arbitrar (CVSS 8.0, Samsung Mobile Devices)
- [CVE-2023-21473](https://cve.now/CVE-2023-21473.md): Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2023-21472](https://cve.now/CVE-2023-21472.md): Improper input validation with Exynos Fastboot USB Interface prior to SMR Apr-2023 Release 1 allows a physical attacker to execute arbitrary (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2023-21471](https://cve.now/CVE-2023-21471.md): Improper access control vulnerability in SemClipboard prior to SMR Apr-2023 Release 1 allows attackers to read arbitrary files with system p (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-21470](https://cve.now/CVE-2023-21470.md): Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-21469](https://cve.now/CVE-2023-21469.md): Improper access control vulnerability in SLocation prior to SMR Apr-2022 Release 1 allows local attackers to get device location information (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-21468](https://cve.now/CVE-2023-21468.md): Improper access control vulnerability in Telephony prior to SMR Apr-2023 Release 1 allows attackers to access files with escalated permissio (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2023-21467](https://cve.now/CVE-2023-21467.md): Error in 3GPP specification implementation in Exynos baseband prior to SMR Apr-2023 Release 1 allows incorrect handling of unencrypted messa (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2023-21466](https://cve.now/CVE-2023-21466.md): PendingIntent hijacking vulnerability in CertificatePolicy in framework prior to SMR Apr-2023 Release 1 allows local attackers to access con (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2025-9785](https://cve.now/CVE-2025-9785.md): Misconfigured certificate validation with self-signed certificates for Print Deploy (CVSS 7.7, PaperCut Print Deploy)
- [CVE-2025-58176](https://cve.now/CVE-2025-58176.md): Dive's improper processing of custom urls can lead to Remote Code Execution (CVSS 8.8, OpenAgentPlatform Dive)
- [CVE-2025-58351](https://cve.now/CVE-2025-58351.md): Outline's Local File Storage Feature can Cause CSP Bypass (CVSS 6.8, outline)
- [CVE-2025-7039](https://cve.now/CVE-2025-7039.md): Glib: buffer under-read on glib through glib/gfileutils.c via get\_tmp\_file() (CVSS 3.7, Red Hat Enterprise Linux)
- [CVE-2025-58163](https://cve.now/CVE-2025-58163.md): FreeScout's deserialization of untrusted data can lead to Remote Code Execution (CVSS 8.6, freescout-help-desk freescout)
- [CVE-2025-9848](https://cve.now/CVE-2025-9848.md): ScriptAndTools Real Estate Management System userlist.php redirect (CVSS 6.9, ScriptAndTools Real Estate Management System)
- [CVE-2025-9847](https://cve.now/CVE-2025-9847.md): ScriptAndTools Real Estate Management System register.php unrestricted upload (CVSS 5.3, ScriptAndTools Real Estate Management System)
- [CVE-2025-57806](https://cve.now/CVE-2025-57806.md): Local Deep Research's API keys are stored in plain text (CVSS 6.9, LearningCircuit local-deep-research)
- [CVE-2025-9845](https://cve.now/CVE-2025-9845.md): code-projects Fruit Shop Management System products.php cross site scripting (CVSS 5.1, code-projects Fruit Shop Management System)
- [CVE-2025-9843](https://cve.now/CVE-2025-9843.md): Das Parking Management System 停车场管理系统 FindAll information disclosure (CVSS 6.9, Das Parking Management System 停车场管理系统)
- [CVE-2025-9842](https://cve.now/CVE-2025-9842.md): Das Parking Management System 停车场管理系统 Search information disclosure (CVSS 6.9, Das Parking Management System 停车场管理系统)
- [CVE-2025-26210](https://cve.now/CVE-2025-26210.md): DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. (CVSS 8.8)
- [CVE-2025-45805](https://cve.now/CVE-2025-45805.md): In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript code into their profile (CVSS 7.6)
- [CVE-2025-52494](https://cve.now/CVE-2025-52494.md): Adacore Ada Web Server (AWS) before 25.2 is vulnerable to a denial-of-service (DoS) condition due to improper handling of SSL handshakes dur (CVSS 7.5)
- [CVE-2025-55852](https://cve.now/CVE-2025-55852.md): Tenda AC8 v16.03.34.06 is vulnerable to Buffer Overflow in the formWifiBasicSet function via the parameter security or security\_5g. (CVSS 7.5)
- [CVE-2025-55944](https://cve.now/CVE-2025-55944.md): Slink v1.4.9 allows stored cross-site scripting (XSS) via crafted SVG uploads. (CVSS 6.1)
- [CVE-2025-56139](https://cve.now/CVE-2025-56139.md): LinkedIn Mobile Application for Android version 4.1.1087.2 fails to update link preview metadata (image, title, description) when a user rep (CVSS 5.3)
- [CVE-2025-56435](https://cve.now/CVE-2025-56435.md): SQL Injection vulnerability in FoxCMS v1.2.6 and before allows a remote attacker to execute arbitrary code via the. (CVSS 5.3)
- [CVE-2025-56498](https://cve.now/CVE-2025-56498.md): An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. (CVSS 5.3)
- [CVE-2025-56608](https://cve.now/CVE-2025-56608.md): The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in \`OkHttpClientWrapper.java\` (CVSS 4.2)
- [CVE-2025-56689](https://cve.now/CVE-2025-56689.md): One Identity by Quest Safeguard for Privileged Passwords Appliance 7.5.1.20903 is vulnerable to One Time Password (OTP)/Multifactor Authenti (CVSS 4.6)
- [CVE-2025-56752](https://cve.now/CVE-2025-56752.md): A vulnerability in the Ruijie RG-ES series switch firmware ESW\_1.0(1)B1P39 enables remote attackers to fully bypass authentication mechanism (CVSS 9.4)
- [CVE-2025-56760](https://cve.now/CVE-2025-56760.md): When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path trav (CVSS 4.3, github.com/usememos/memos)
- [CVE-2025-56761](https://cve.now/CVE-2025-56761.md): Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. (CVSS 5.4, github.com/usememos/memos)
- [CVE-2025-56803](https://cve.now/CVE-2025-56803.md): Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. (CVSS 8.4)
- [CVE-2025-57052](https://cve.now/CVE-2025-57052.md): cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode\_array\_index\_from\_pointer function in cJSON\_Utils.c, allowing remote at (CVSS 9.8)
- [CVE-2025-57146](https://cve.now/CVE-2025-57146.md): phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter. (CVSS 8.1)
- [CVE-2025-57147](https://cve.now/CVE-2025-57147.md): A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. (CVSS 7.5)
- [CVE-2025-57148](https://cve.now/CVE-2025-57148.md): phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension vali (CVSS 9.1)
- [CVE-2025-57149](https://cve.now/CVE-2025-57149.md): phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter. (CVSS 6.5)
- [CVE-2025-57150](https://cve.now/CVE-2025-57150.md): phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName (CVSS 7.2)
- [CVE-2025-57151](https://cve.now/CVE-2025-57151.md): phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter. (CVSS 8.8)
- [CVE-2025-57833](https://cve.now/CVE-2025-57833.md): An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. (CVSS 7.1, djangoproject Django · django)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.