CVEs published September 8, 2025
96 CVEs were published on September 8, 2025: 13 critical, 29 high.
- Published
- 96
- Critical
- 13
- High
- 29
- Medium
- 45
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- SourceCodester Online Polling System
- 5
- ethyca fides · ethyca-fides
- 4
- LabRedesCefetRJ WeGIA
- 4
- code-projects Online Event Judging System
- 3
- Jinher OA
- 3
- Project-MONAI MONAI · monai
- 3
- SourceCodester Pet Grooming Management Software
- 3
- Campcodes Online Loan Management System
- 2
- dreamstechnologies Doccure
- 2
- itsourcecode Student Information Management System
- 2
Critical 13
- CVE-2025-58746Volkov Labs Business Links plugin vulnerable to privilege escalation attackVolkovLabs business-links
- CVE-2025-58745WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)LabRedesCefetRJ WeGIA
- CVE-2025-58450pREST has Systemic SQL Injection Vulnerabilityprest · github.com/prest/prest/v2 +1
- CVE-2025-54994@akoskm/create-mcp-server-stdio has Command Injection in MCP Server due to unsafe `exec` APIakoskm create-mcp-server-stdio · @akoskm/create-mcp-server-…
- CVE-2025-9114Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Changedreamstechnologies Doccure
- CVE-2025-9113Doccure Core <= 1.5.3 - Unauthenticated Arbitrary File Uploaddreamstechnologies Doccure Core
- CVE-2025-5993Path Traversal in ITCube CRMITCube Software ITCube CRM
- CVE-2025-22956OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients.
- CVE-2025-52161Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability.
- CVE-2025-56266A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.
- CVE-2025-56267A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplyi
- CVE-2025-57141rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.
- CVE-2025-57285codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js).codeceptjs
High 29
- CVE-2025-58757MONAI's unsafe use of Pickle deserialization may lead to RCEProject-MONAI MONAI · monai
- CVE-2025-58756MONAI's unsafe torch usage may lead to arbitrary code executionProject-MONAI MONAI · monai
- CVE-2025-58755MONAI has path traversal issue that may lead to arbitrary file writesProject-MONAI MONAI · monai
- CVE-2025-58454WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'listar_despachos.php' parameter 'id_memorando'LabRedesCefetRJ WeGIA
- CVE-2025-58453WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'exibe_anexo.php' parameter 'id_anexo'LabRedesCefetRJ WeGIA
- CVE-2025-58451Cattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource ConsumptionIEatUranium238 Cattown · cattown
- CVE-2025-58449Maho Vulnerable to Authenticated Remote Code Execution via File UploadMahoCommerce maho · mahocommerce/maho
- CVE-2025-58444MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Servermodelcontextprotocol inspector · @modelcontextprotocol/insp…
- CVE-2025-58365XWiki Blog Application: Privilege Escalation (PR) from account through blog contentxwiki-contrib application-blog · org.xwiki.contrib.blog:app…
- CVE-2025-57817Fides Webserver API is Vulnerable to OAuth Client Privilege Escalationethyca fides · ethyca-fides
- CVE-2025-53838LinkAce has a Stored One Click XSS vulnerabilityKovah LinkAce
- CVE-2025-9112Doccure <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Uploaddreamstechnologies Doccure
- CVE-2025-40930JSON::SIMD before version 1.07 and earlier for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impactPJUHASZ JSON::SIMD
- CVE-2025-40928JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impactMLEHMANN JSON::XS
- CVE-2025-36855EOL .NET 6.0 Runtime Remote Code Execution VulnerabilityMicrosoft .NET
- CVE-2025-36854EOL ASP.NET 6.0 Remote Code Execution VulnerabilityMicrosoft .NET · Microsoft.AspNetCore.Identity +12
- CVE-2025-36853EOL .NET 6.0 Runtime Remote Code Execution VulnerabilityMicrosoft .NET · Microsoft.NetCore.App.Runtime.linux-arm +11
- CVE-2025-41664Improper Permission Handling Enables Unauthorized Access to Firmware and CertificatesWAGO Coupler 0750-0362 · WAGO Coupler 0750-0362/0000-0001 +8
- CVE-2025-41708Cleartext Transmission of Sensitive Data via Insecure HTTP Web InterfaceBender CC612 · Bender CC613 +3
- CVE-2025-41682Credential Disclosure via Insecure Storage on Charge ControllerBender CC612 · Bender CC613 +2
- CVE-2025-8085Ditty < 3.1.58 - Unauthenticated SSRFDitty
- CVE-2022-50238The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules.Microsoft Windows
- CVE-2025-52288Assertion failure in function ngap_build_downlink_nas_transport in file src/amf/ngap-build.c, the Access and Mobility Management Function (A
- CVE-2025-52389An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attackers to access sensiti
- CVE-2025-55849WeiPHP v5.0 and before is vulnerable to SQL Injection via the SucaiController.class.php file and the cancelTemplatee
- CVE-2025-55998A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitra
- CVE-2025-56265An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbi@n8n/n8n-nodes-langchain
- CVE-2025-56630FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column_model parameter in the app/admin/controller/Column.php file.
- CVE-2025-59033The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy.Microsoft Windows
Medium, low and unrated 54
- CVE-2025-10112itsourcecode Student Information Management System index.php sql injectionitsourcecode Student Information Management System
- CVE-2025-43763A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2Liferay Portal · Liferay DXP +1
- CVE-2025-10111itsourcecode Student Information Management System index.php sql injectionitsourcecode Student Information Management System
- CVE-2025-58752Vite's `server.fs` settings were not applied to HTML filesvitejs vite · vite
- CVE-2025-58751Vite middleware may serve files starting with the same name with the public directoryvitejs vite · vite
- CVE-2025-10110ChanCMS search sql injectionChanCMS
- CVE-2025-10109Campcodes Online Loan Management System ajax.php sql injectionCampcodes Online Loan Management System
- CVE-2025-58452WeGIA vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint 'listar_despachos.php' parameter 'id_memorando'LabRedesCefetRJ WeGIA
- CVE-2025-1761IBM Concert Software information disclosureIBM Concert Software
- CVE-2025-10108Campcodes Online Loan Management System ajax.php sql injectionCampcodes Online Loan Management System
- CVE-2025-10106yanyutao0402 ChanCMS search sql injectionyanyutao0402 ChanCMS
- CVE-2025-57816Fides Webserver API Rate Limiting Vulnerability in Proxied Environmentsethyca fides · ethyca-fides
- CVE-2025-57766Fides's Admin UI User Password Change Does Not Invalidate Current Sessionethyca fides · ethyca-fides
- CVE-2025-57815Fides Lacks Brute-Force Protections on Authentication Endpointsethyca fides · ethyca-fides
- CVE-2025-10105yanyutao0402 ChanCMS search sql injectionyanyutao0402 ChanCMS
- CVE-2025-10104code-projects Online Event Judging System review_search.php sql injectioncode-projects Online Event Judging System
- CVE-2025-10103code-projects Online Event Judging System home.php sql injectioncode-projects Online Event Judging System
- CVE-2025-43722Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper privilege management vulnerability.Dell PowerScale OneFS
- CVE-2025-10102code-projects Online Event Judging System index.php sql injectioncode-projects Online Event Judging System
- CVE-2025-10100SourceCodester Simple Forum Discussion System admin_class.php sql injectionSourceCodester Simple Forum Discussion System
- CVE-2025-10099Portabilis i-Educar Editar usuário educar_usuario_cad.php cross site scriptingPortabilis i-Educar
- CVE-2025-10098PHPGurukul User Management System edit-user-profile.php sql injectionPHPGurukul User Management System
- CVE-2025-10097SimStudioAI sim route.ts code injectionSimStudioAI sim · simstudio
- CVE-2025-10096SimStudioAI sim route.ts server-side request forgerySimStudioAI sim
- CVE-2025-40929Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impactRURBAN Cpanel::JSON::XS
- CVE-2025-7709Out Of Bounds write in FTS5 Extension in SQLiteSQLite FTS5
- CVE-2025-3212Mali GPU Kernel Driver allows access to already freed memoryArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- CVE-2025-10093D-Link DIR-852 Device Configuration getcfg.php phpcgi_main information disclosureD-Link DIR-852
- CVE-2025-40641Stored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management SystemMulti-Purpose Inventory Management System
- CVE-2025-10092Jinher OA XML Type xml external entity referenceJinher OA
- CVE-2025-40642Reflected Cross-Site Scripting (XSS) in WebWorkWebWork PHP script
- CVE-2025-10091Jinher OA XML Type xml external entity referenceJinher OA
- CVE-2014-125128'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS).sanitize-html
- CVE-2019-25225`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS).sanitize-html
- CVE-2025-10090Jinher OA GetTreeDate.aspx sql injectionJinher OA
- CVE-2025-58782Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactoryApache Software Foundation Apache Jackrabbit Core · Apac… +2
- CVE-2025-10088SourceCodester Time Tracker index.html cross site scriptingSourceCodester Time Tracker
- CVE-2025-10087SourceCodester Pet Grooming Management Software profit_report.php sql injectionSourceCodester Pet Grooming Management Software
- CVE-2025-10086fuyang_lipengjun platform AdPositionController queryAll improper authorizationfuyang_lipengjun platform
- CVE-2025-10085SourceCodester Pet Grooming Management Software manage_website.php unrestricted uploadSourceCodester Pet Grooming Management Software
- CVE-2025-10084elunez eladmin SysLogController 1 queryErrorLogDetail improper authorizationelunez eladmin
- CVE-2025-58422RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history.Ricoh Company RICOH Streamline NX
- CVE-2025-10083SourceCodester Pet Grooming Management Software profile.php unrestricted uploadSourceCodester Pet Grooming Management Software
- CVE-2025-10082SourceCodester Online Polling System manage-admins.php sql injectionSourceCodester Online Polling System
- CVE-2025-10081SourceCodester Pet Management System profile.php unrestricted uploadSourceCodester Pet Management System
- CVE-2025-10080running-elephant Datart API AESUtil.java getTokensecret hard-coded keyrunning-elephant Datart
- CVE-2025-10079PHPGurukul Small CRM get-quote.php sql injectionPHPGurukul Small CRM
- CVE-2025-10078SourceCodester Online Polling System candidates.php sql injectionSourceCodester Online Polling System
- CVE-2025-10077SourceCodester Online Polling System registeracc.php sql injectionSourceCodester Online Polling System
- CVE-2025-10076SourceCodester Online Polling System manage-profile.php sql injectionSourceCodester Online Polling System
- CVE-2025-10075SourceCodester Online Polling System manage-profile.php cross site scriptingSourceCodester Online Polling System
- CVE-2025-10074Portabilis i-Educar tipos cross site scriptingPortabilis i-Educar
- CVE-2024-48341dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop
- CVE-2025-51586An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive inprestashop/prestashop