# CVEs published 2025-09-06 60 CVEs were published on September 6, 2025: 3 critical, 16 high. Days are UTC. - [CVE-2025-10063](https://cve.now/CVE-2025-10063.md): itsourcecode POS Point of Sale System deferred\_table.php cross site scripting (CVSS 5.3, itsourcecode POS Point of Sale System) - [CVE-2025-10062](https://cve.now/CVE-2025-10062.md): itsourcecode Student Information Management System login.php sql injection (CVSS 6.9, itsourcecode Student Information Management System) - [CVE-2025-58443](https://cve.now/CVE-2025-58443.md): FOG's authentication bypass leads to full SQL DB dump (CVSS 9.9, fogproject) - [CVE-2025-58445](https://cve.now/CVE-2025-58445.md): Atlantis Exposes Service Version Publicly on /status API Endpoint (CVSS 6.9, runatlantis atlantis · github.com/runatlantis/atlantis) - [CVE-2025-58446](https://cve.now/CVE-2025-58446.md): xgrammar vulnerable to denial of service by huge enum grammar (CVSS 6.9, mlc-ai xgrammar · xgrammar) - [CVE-2025-58438](https://cve.now/CVE-2025-58438.md): internetarchive is vulnerable to Directory Traversal through file downloads (CVSS 9.4, jjjake internetarchive · internetarchive) - [CVE-2025-0034](https://cve.now/CVE-2025-0034.md): Insufficient parameter sanitization in TEE SOC Driver could allow an attacker to issue a malformed DRV\_SOC\_CMD\_ID\_SRIOV\_SPATIAL\_PART and cau (CVSS 4.7, AMD Instinct™ MI300X · AMD Instinct™ MI325X) - [CVE-2025-0032](https://cve.now/CVE-2025-0032.md): Improper cleanup in AMD CPU microcode patch loading could allow an attacker with local administrator privilege to load malicious CPU microco (CVSS 7.2, AMD EPYC™ 9005 Series Processors · AMD Ryzen™ AI 300 Ser… +5) - [CVE-2025-0011](https://cve.now/CVE-2025-0011.md): Improper removal of sensitive information before storage or transfer in AMD Crash Defender could allow an attacker to obtain kernel address (CVSS 3.3, AMD Ryzen™ 8000 Series Desktop Processors · AMD Ryzen™… +17) - [CVE-2025-0010](https://cve.now/CVE-2025-0010.md): An out of bounds write in the Linux graphics driver could allow an attacker to overflow the buffer potentially resulting in loss of confiden (CVSS 6.1, AMD Radeon™ RX 5000 Series Graphics Products · AMD Rade… +33) - [CVE-2025-0009](https://cve.now/CVE-2025-0009.md): A NULL pointer dereference in AMD Crash Defender could allow an attacker to write a NULL output to a log file potentially resulting in a sys (CVSS 5.5, AMD Ryzen™ 7035 Series Processor with Radeon™ Graphics… +26) - [CVE-2024-36354](https://cve.now/CVE-2024-36354.md): Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys (CVSS 7.5, AMD Ryzen™ Threadripper™ 3000 Processors · AMD Ryzen™ T… +34) - [CVE-2024-36352](https://cve.now/CVE-2024-36352.md): Improper input validation in the AMD Graphics Driver could allow an attacker to supply a specially crafted pointer, potentially leading to a (CVSS 8.4, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +26) - [CVE-2024-36346](https://cve.now/CVE-2024-36346.md): Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input da (CVSS 6.0, AMD Instinct™ MI300A · AMD Instinct™ MI300X) - [CVE-2024-36342](https://cve.now/CVE-2024-36342.md): Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execu (CVSS 8.8, AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ G… +38) - [CVE-2024-36331](https://cve.now/CVE-2024-36331.md): Improper initialization of CPU cache memory could allow a privileged attacker with hypervisor access to overwrite SEV-SNP guest memory resul (CVSS 3.2, AMD EPYC™ 9004 Series Processors · AMD EPYC™ Embedded 90… +1) - [CVE-2024-36326](https://cve.now/CVE-2024-36326.md): Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, pote (CVSS 8.4, AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graph…) - [CVE-2024-21970](https://cve.now/CVE-2024-21970.md): Improper validation of an array index in the AND power Management Firmware could allow a privileged attacker to corrupt AGESA memory potenti (CVSS 4.4, AMD Ryzen™ Threadripper™ 3000 Processors · AMD Ryzen™ T… +23) - [CVE-2024-21947](https://cve.now/CVE-2024-21947.md): Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially re (CVSS 7.5, AMD Ryzen™ Threadripper™ 3000 Processors · AMD Ryzen™ T… +23) - [CVE-2023-31365](https://cve.now/CVE-2023-31365.md): An integer overflow in the SMU could allow a privileged attacker to potentially write memory beyond the end of the reserved dRAM area result (CVSS 3.9, AMD Radeon™ RX 7000 Series Graphics Products · AMD Radeo… +1) - [CVE-2023-31351](https://cve.now/CVE-2023-31351.md): Improper restriction of operations in the IOMMU could allow a malicious hypervisor to access guest private memory resulting in loss of integ (CVSS 5.3, AMD EPYC™ 7003 Series Processors · AMD EPYC™ 9004 Series… +3) - [CVE-2023-31330](https://cve.now/CVE-2023-31330.md): An out-of-bounds read in the ASP could allow a privileged attacker with access to a malicious bootloader to potentially read sensitive memor (CVSS 2.5, AMD Ryzen™ Threadripper™ 3000 Processors · AMD Ryzen™ T… +17) - [CVE-2023-31326](https://cve.now/CVE-2023-31326.md): Use of an uninitialized variable in the ASP could allow an attacker to access leftover data from a trusted execution environment (TEE) drive (CVSS 2.8, AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ G… +13) - [CVE-2023-31325](https://cve.now/CVE-2023-31325.md): Improper isolation of shared resources on System-on-a-chip (SOC) could a privileged attacker to tamper with the contents of the PSP reserved (CVSS 7.2, AMD Ryzen™ 8000 Series Desktop Processors · AMD Ryzen™ 7… +2) - [CVE-2023-31322](https://cve.now/CVE-2023-31322.md): Type confusion in the ASP could allow an attacker to pass a malformed argument to the Reliability, Availability, and Serviceability trusted (CVSS 8.7, AMD Radeon™ RX 7000 Series Graphics Products · -AMD Radeon™…) - [CVE-2023-31306](https://cve.now/CVE-2023-31306.md): Improper validation of an array index in the AMD graphics driver software could allow an attacker to pass malformed arguments to the dynamic (CVSS 3.3, AMD Radeon™ RX 5000 Series Graphics Products · AMD Radeo… +4) - [CVE-2023-20516](https://cve.now/CVE-2023-20516.md): Improper handling of insufficiency privileges in the ASP could allow a privileged attacker to modify Translation Map Registers (TMRs) potent (CVSS 3.3, AMD Instinct™ MI250 · AMD Instinct™ MI210 +3) - [CVE-2021-46750](https://cve.now/CVE-2021-46750.md): Failure to validate the address and size in TEE (Trusted Execution Environment) may allow a malicious x86 attacker to send malformed message (CVSS 3.0, AMD Athlon™ 3000 Series Mobile Processors with Radeon™… +14) - [CVE-2021-26377](https://cve.now/CVE-2021-26377.md): Insufficient parameter validation while allocating process space in the Trusted OS (TOS) may allow for a malicious userspace process to trig (CVSS 4.1, AMD Ryzen™ 5000 Series Processors with Radeon™ Graphics… +23) - [CVE-2025-10034](https://cve.now/CVE-2025-10034.md): D-Link DIR-825 httpd ping6\_response.cg get\_ping6\_app\_stat buffer overflow (CVSS 8.7, D-Link DIR-825) - [CVE-2025-10033](https://cve.now/CVE-2025-10033.md): itsourcecode Online Discussion Forum admin sql injection (CVSS 6.9, itsourcecode Online Discussion Forum) - [CVE-2025-10032](https://cve.now/CVE-2025-10032.md): Campcodes Grocery Sales and Inventory System index.php cross site scripting (CVSS 5.3, Campcodes Grocery Sales and Inventory System) - [CVE-2025-10031](https://cve.now/CVE-2025-10031.md): Campcodes Grocery Sales and Inventory System ajax.php sql injection (CVSS 6.9, Campcodes Grocery Sales and Inventory System) - [CVE-2025-10030](https://cve.now/CVE-2025-10030.md): Campcodes Grocery Sales and Inventory System ajax.php sql injection (CVSS 6.9, Campcodes Grocery Sales and Inventory System) - [CVE-2025-10029](https://cve.now/CVE-2025-10029.md): itsourcecode POS Point of Sale System complex\_header\_2.php cross site scripting (CVSS 5.1, itsourcecode POS Point of Sale System) - [CVE-2025-9961](https://cve.now/CVE-2025-9961.md): Authenticated RCE by CWMP binary (CVSS 8.6, TP-Link Systems AX10 V1/V1.2/V2/V2.6/V3/V3.6 · TP-Link Syst…) - [CVE-2025-10046](https://cve.now/CVE-2025-10046.md): ELEX WooCommerce Google Shopping (Google Product Feed) \<= 1.4.3 - Authenticated (Admin+) SQL Inejction (CVSS 4.9, elextensions ELEX WooCommerce Google Shopping) - [CVE-2025-10028](https://cve.now/CVE-2025-10028.md): itsourcecode POS Point of Sale System 6776.php cross site scripting (CVSS 5.1, itsourcecode POS Point of Sale System) - [CVE-2025-6757](https://cve.now/CVE-2025-6757.md): Recent Posts Widget Extended \<= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via rpwe Shortcode (CVSS 6.4, themejunkie Recent Posts Widget Extended) - [CVE-2025-8149](https://cve.now/CVE-2025-8149.md): aThemes Addons for Elementor Lite \<= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, smub aThemes Addons for Elementor) - [CVE-2025-8564](https://cve.now/CVE-2025-8564.md): SKT Addons for Elementor \<= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, sonalsinha21 SKT Addons for Elementor) - [CVE-2025-7045](https://cve.now/CVE-2025-7045.md): Cloud SAML SSO \<= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete\_config Action (CVSS 6.5, cloudinfrastructureservices Cloud SAML SSO – Single Sign On…) - [CVE-2025-9493](https://cve.now/CVE-2025-9493.md): Admin Menu Editor \<= 1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder Parameter (CVSS 6.4, whiteshadow Admin Menu Editor) - [CVE-2025-7040](https://cve.now/CVE-2025-7040.md): Cloud SAML SSO \<= 1.0.19 - Missing Authorization to Unauthenticated Settings Modification via set\_organization\_settings Action (CVSS 8.2, cloudinfrastructureservices Cloud SAML SSO – Single Sign On…) - [CVE-2025-9442](https://cve.now/CVE-2025-9442.md): StreamWeasels Kick Integration \<= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via vodsChannel Parameter (CVSS 6.4, StreamWeasels Kick Integration) - [CVE-2025-9126](https://cve.now/CVE-2025-9126.md): Smart Table Builder \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, designful Smart Table Builder) - [CVE-2025-8722](https://cve.now/CVE-2025-8722.md): Content Views \<= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Grid and List Widgets (CVSS 6.4, pt-guy Content Views – Post Grid & Filter, Recent Posts, Ca…) - [CVE-2025-58437](https://cve.now/CVE-2025-58437.md): Coder's privilege escalation vulnerability could lead to a cross workspace compromise (CVSS 8.1, coder · github.com/coder/coder +1) - [CVE-2025-10003](https://cve.now/CVE-2025-10003.md): UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP \<= 1.2.44 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, stiofansisland UsersWP – Front-end login form, User Registr…) - [CVE-2025-9853](https://cve.now/CVE-2025-9853.md): Optio Dentistry \<= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Optio Dentistry) - [CVE-2025-8359](https://cve.now/CVE-2025-8359.md): AdForest \<= 6.0.9 - Authentication Bypass to Admin (CVSS 9.8, scriptsbundle AdForest) - [CVE-2025-9085](https://cve.now/CVE-2025-9085.md): User Registration & Membership \<= 4.3.0 - Authenticated (Admin+) SQL Injection (CVSS 4.9, wpeverest User Registration & Membership – Free & Paid Memb…) - [CVE-2025-9515](https://cve.now/CVE-2025-9515.md): Multi Step Form \<= 1.7.25 - Authenticated (Admin+) Arbitrary File Upload (CVSS 7.2, mondula2016 Multi Step Form) - [CVE-2025-8360](https://cve.now/CVE-2025-8360.md): LA-Studio Element Kit for Elementor \<= 1.5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, choijun LA-Studio Element Kit for Elementor) - [CVE-2025-58374](https://cve.now/CVE-2025-58374.md): Roo Code: Auto-approve allows npm install execution of malicious postinstall scripts (CVSS 7.8, RooCodeInc Roo-Code) - [CVE-2025-6067](https://cve.now/CVE-2025-6067.md): Easy Social Feed – Social Photos Gallery – Post Feed – Like Box \<= 6.6.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, sjaved Easy Social Feed – Social Photos Gallery and Post Fe…) - [CVE-2025-9849](https://cve.now/CVE-2025-9849.md): Html Social share buttons \<= 2.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, alimuzzamanalim Html Social share buttons) - [CVE-2025-7368](https://cve.now/CVE-2025-7368.md): Rehub \<= 19.9.7 - Unauthenticated Password Protected Post Disclosure (CVSS 5.3, sizam REHub - Price Comparison, Multi Vendor Marketplace Wo…) - [CVE-2025-7366](https://cve.now/CVE-2025-7366.md): Rehub \<= 19.9.7 - Unauthenticated Arbitrary Shortcode Execution via re\_filterpost (CVSS 7.3, sizam REHub - Price Comparison, Multi Vendor Marketplace Wo…) - [CVE-2025-58439](https://cve.now/CVE-2025-58439.md): ERP: Possibility of SQL injection due to missing validation (CVSS 8.1, frappe erpnext) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-09-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.