# CVEs published 2025-09-08

96 CVEs were published on September 8, 2025: 13 critical, 29 high. Days are UTC.

- [CVE-2025-58757](https://cve.now/CVE-2025-58757.md): MONAI's unsafe use of Pickle deserialization may lead to RCE (CVSS 8.8, Project-MONAI MONAI · monai)
- [CVE-2025-58756](https://cve.now/CVE-2025-58756.md): MONAI's unsafe torch usage may lead to arbitrary code execution (CVSS 8.8, Project-MONAI MONAI · monai)
- [CVE-2025-58755](https://cve.now/CVE-2025-58755.md): MONAI has path traversal issue that may lead to arbitrary file writes (CVSS 8.8, Project-MONAI MONAI · monai)
- [CVE-2025-10112](https://cve.now/CVE-2025-10112.md): itsourcecode Student Information Management System index.php sql injection (CVSS 6.9, itsourcecode Student Information Management System)
- [CVE-2025-43763](https://cve.now/CVE-2025-43763.md): A server-side request forgery (SSRF) vulnerability exist in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2 (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-10111](https://cve.now/CVE-2025-10111.md): itsourcecode Student Information Management System index.php sql injection (CVSS 6.9, itsourcecode Student Information Management System)
- [CVE-2025-58752](https://cve.now/CVE-2025-58752.md): Vite's \`server.fs\` settings were not applied to HTML files (CVSS 2.3, vitejs vite · vite)
- [CVE-2025-58751](https://cve.now/CVE-2025-58751.md): Vite middleware may serve files starting with the same name with the public directory (CVSS 2.3, vitejs vite · vite)
- [CVE-2025-58746](https://cve.now/CVE-2025-58746.md): Volkov Labs Business Links plugin vulnerable to privilege escalation attack (CVSS 9.1, VolkovLabs business-links)
- [CVE-2025-58745](https://cve.now/CVE-2025-58745.md): WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE) (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-58454](https://cve.now/CVE-2025-58454.md): WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'listar\_despachos.php' parameter 'id\_memorando' (CVSS 8.9, LabRedesCefetRJ WeGIA)
- [CVE-2025-10110](https://cve.now/CVE-2025-10110.md): ChanCMS search sql injection (CVSS 5.3, ChanCMS)
- [CVE-2025-10109](https://cve.now/CVE-2025-10109.md): Campcodes Online Loan Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Loan Management System)
- [CVE-2025-58453](https://cve.now/CVE-2025-58453.md): WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'exibe\_anexo.php' parameter 'id\_anexo' (CVSS 8.9, LabRedesCefetRJ WeGIA)
- [CVE-2025-58452](https://cve.now/CVE-2025-58452.md): WeGIA vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint 'listar\_despachos.php' parameter 'id\_memorando' (CVSS 2.1, LabRedesCefetRJ WeGIA)
- [CVE-2025-1761](https://cve.now/CVE-2025-1761.md): IBM Concert Software information disclosure (CVSS 5.9, IBM Concert Software)
- [CVE-2025-58451](https://cve.now/CVE-2025-58451.md): Cattown Vulnerable to Inefficient Regular Expression Complexity and Uncontrolled Resource Consumption (CVSS 8.7, IEatUranium238 Cattown · cattown)
- [CVE-2025-10108](https://cve.now/CVE-2025-10108.md): Campcodes Online Loan Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Loan Management System)
- [CVE-2025-58450](https://cve.now/CVE-2025-58450.md): pREST has Systemic SQL Injection Vulnerability (CVSS 9.3, prest · github.com/prest/prest/v2 +1)
- [CVE-2025-10106](https://cve.now/CVE-2025-10106.md): yanyutao0402 ChanCMS search sql injection (CVSS 5.3, yanyutao0402 ChanCMS)
- [CVE-2025-58449](https://cve.now/CVE-2025-58449.md): Maho Vulnerable to Authenticated Remote Code Execution via File Upload (CVSS 8.7, MahoCommerce maho · mahocommerce/maho)
- [CVE-2025-58444](https://cve.now/CVE-2025-58444.md): MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server (CVSS 8.6, modelcontextprotocol inspector · @modelcontextprotocol/insp…)
- [CVE-2025-58365](https://cve.now/CVE-2025-58365.md): XWiki Blog Application: Privilege Escalation (PR) from account through blog content (CVSS 8.7, xwiki-contrib application-blog · org.xwiki.contrib.blog:app…)
- [CVE-2025-57817](https://cve.now/CVE-2025-57817.md): Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation (CVSS 8.6, ethyca fides · ethyca-fides)
- [CVE-2025-57816](https://cve.now/CVE-2025-57816.md): Fides Webserver API Rate Limiting Vulnerability in Proxied Environments (CVSS 6.3, ethyca fides · ethyca-fides)
- [CVE-2025-57766](https://cve.now/CVE-2025-57766.md): Fides's Admin UI User Password Change Does Not Invalidate Current Session (CVSS 1.7, ethyca fides · ethyca-fides)
- [CVE-2025-57815](https://cve.now/CVE-2025-57815.md): Fides Lacks Brute-Force Protections on Authentication Endpoints (CVSS 1.7, ethyca fides · ethyca-fides)
- [CVE-2025-10105](https://cve.now/CVE-2025-10105.md): yanyutao0402 ChanCMS search sql injection (CVSS 5.3, yanyutao0402 ChanCMS)
- [CVE-2025-10104](https://cve.now/CVE-2025-10104.md): code-projects Online Event Judging System review\_search.php sql injection (CVSS 6.9, code-projects Online Event Judging System)
- [CVE-2025-54994](https://cve.now/CVE-2025-54994.md): @akoskm/create-mcp-server-stdio has Command Injection in MCP Server due to unsafe \`exec\` API (CVSS 9.3, akoskm create-mcp-server-stdio · @akoskm/create-mcp-server-…)
- [CVE-2025-53838](https://cve.now/CVE-2025-53838.md): LinkAce has a Stored One Click XSS vulnerability (CVSS 8.4, Kovah LinkAce)
- [CVE-2025-10103](https://cve.now/CVE-2025-10103.md): code-projects Online Event Judging System home.php sql injection (CVSS 6.9, code-projects Online Event Judging System)
- [CVE-2025-43722](https://cve.now/CVE-2025-43722.md): Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an improper privilege management vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2025-10102](https://cve.now/CVE-2025-10102.md): code-projects Online Event Judging System index.php sql injection (CVSS 6.9, code-projects Online Event Judging System)
- [CVE-2025-9114](https://cve.now/CVE-2025-9114.md): Doccure \<= 1.5.0 - Unauthenticated Arbitrary User Password Change (CVSS 9.8, dreamstechnologies Doccure)
- [CVE-2025-9113](https://cve.now/CVE-2025-9113.md): Doccure Core \<= 1.5.3 - Unauthenticated Arbitrary File Upload (CVSS 9.8, dreamstechnologies Doccure Core)
- [CVE-2025-9112](https://cve.now/CVE-2025-9112.md): Doccure \<= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, dreamstechnologies Doccure)
- [CVE-2025-10100](https://cve.now/CVE-2025-10100.md): SourceCodester Simple Forum Discussion System admin\_class.php sql injection (CVSS 6.9, SourceCodester Simple Forum Discussion System)
- [CVE-2025-10099](https://cve.now/CVE-2025-10099.md): Portabilis i-Educar Editar usuário educar\_usuario\_cad.php cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-10098](https://cve.now/CVE-2025-10098.md): PHPGurukul User Management System edit-user-profile.php sql injection (CVSS 5.3, PHPGurukul User Management System)
- [CVE-2025-10097](https://cve.now/CVE-2025-10097.md): SimStudioAI sim route.ts code injection (CVSS 5.3, SimStudioAI sim · simstudio)
- [CVE-2025-10096](https://cve.now/CVE-2025-10096.md): SimStudioAI sim route.ts server-side request forgery (CVSS 5.3, SimStudioAI sim)
- [CVE-2025-40930](https://cve.now/CVE-2025-40930.md): JSON::SIMD before version 1.07 and earlier for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact (CVSS 7.5, PJUHASZ JSON::SIMD)
- [CVE-2025-40929](https://cve.now/CVE-2025-40929.md): Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact (CVSS 5.6, RURBAN Cpanel::JSON::XS)
- [CVE-2025-40928](https://cve.now/CVE-2025-40928.md): JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact (CVSS 7.5, MLEHMANN JSON::XS)
- [CVE-2025-7709](https://cve.now/CVE-2025-7709.md): Out Of Bounds write in FTS5 Extension in SQLite (CVSS 6.9, SQLite FTS5)
- [CVE-2025-36855](https://cve.now/CVE-2025-36855.md): EOL .NET 6.0 Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft .NET)
- [CVE-2025-36854](https://cve.now/CVE-2025-36854.md): EOL ASP.NET 6.0 Remote Code Execution Vulnerability (CVSS 8.1, Microsoft .NET · Microsoft.AspNetCore.Identity +12)
- [CVE-2025-36853](https://cve.now/CVE-2025-36853.md): EOL .NET 6.0 Runtime Remote Code Execution Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft.NetCore.App.Runtime.linux-arm +11)
- [CVE-2025-3212](https://cve.now/CVE-2025-3212.md): Mali GPU Kernel Driver allows access to already freed memory (CVSS 5.3, Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1)
- [CVE-2025-10093](https://cve.now/CVE-2025-10093.md): D-Link DIR-852 Device Configuration getcfg.php phpcgi\_main information disclosure (CVSS 6.9, D-Link DIR-852)
- [CVE-2025-40641](https://cve.now/CVE-2025-40641.md): Stored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management System (CVSS 5.1, Multi-Purpose Inventory Management System)
- [CVE-2025-10092](https://cve.now/CVE-2025-10092.md): Jinher OA XML Type xml external entity reference (CVSS 6.9, Jinher OA)
- [CVE-2025-40642](https://cve.now/CVE-2025-40642.md): Reflected Cross-Site Scripting (XSS) in WebWork (CVSS 5.1, WebWork PHP script)
- [CVE-2025-10091](https://cve.now/CVE-2025-10091.md): Jinher OA XML Type xml external entity reference (CVSS 6.9, Jinher OA)
- [CVE-2025-5993](https://cve.now/CVE-2025-5993.md): Path Traversal in ITCube CRM (CVSS 9.2, ITCube Software ITCube CRM)
- [CVE-2014-125128](https://cve.now/CVE-2014-125128.md): 'sanitize-html' prior to version 1.0.3 is vulnerable to Cross-site Scripting (XSS). (CVSS 6.1, sanitize-html)
- [CVE-2019-25225](https://cve.now/CVE-2019-25225.md): \`sanitize-html\` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). (CVSS 6.1, sanitize-html)
- [CVE-2025-10090](https://cve.now/CVE-2025-10090.md): Jinher OA GetTreeDate.aspx sql injection (CVSS 6.9, Jinher OA)
- [CVE-2025-58782](https://cve.now/CVE-2025-58782.md): Apache Jackrabbit Core, Apache Jackrabbit JCR Commons: JNDI injection risk with JndiRepositoryFactory (CVSS 6.5, Apache Software Foundation Apache Jackrabbit Core · Apac… +2)
- [CVE-2025-10088](https://cve.now/CVE-2025-10088.md): SourceCodester Time Tracker index.html cross site scripting (CVSS 5.1, SourceCodester Time Tracker)
- [CVE-2025-41664](https://cve.now/CVE-2025-41664.md): Improper Permission Handling Enables Unauthorized Access to Firmware and Certificates (CVSS 7.5, WAGO Coupler 0750-0362 · WAGO Coupler 0750-0362/0000-0001 +8)
- [CVE-2025-41708](https://cve.now/CVE-2025-41708.md): Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface (CVSS 7.4, Bender CC612 · Bender CC613 +3)
- [CVE-2025-41682](https://cve.now/CVE-2025-41682.md): Credential Disclosure via Insecure Storage on Charge Controller (CVSS 8.8, Bender CC612 · Bender CC613 +2)
- [CVE-2025-10087](https://cve.now/CVE-2025-10087.md): SourceCodester Pet Grooming Management Software profit\_report.php sql injection (CVSS 5.1, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10086](https://cve.now/CVE-2025-10086.md): fuyang\_lipengjun platform AdPositionController queryAll improper authorization (CVSS 5.3, fuyang\_lipengjun platform)
- [CVE-2025-8085](https://cve.now/CVE-2025-8085.md): Ditty \< 3.1.58 - Unauthenticated SSRF (CVSS 8.6, Ditty)
- [CVE-2025-10085](https://cve.now/CVE-2025-10085.md): SourceCodester Pet Grooming Management Software manage\_website.php unrestricted upload (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10084](https://cve.now/CVE-2025-10084.md): elunez eladmin SysLogController 1 queryErrorLogDetail improper authorization (CVSS 5.3, elunez eladmin)
- [CVE-2025-58422](https://cve.now/CVE-2025-58422.md): RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. (CVSS 3.1, Ricoh Company RICOH Streamline NX)
- [CVE-2025-10083](https://cve.now/CVE-2025-10083.md): SourceCodester Pet Grooming Management Software profile.php unrestricted upload (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2025-10082](https://cve.now/CVE-2025-10082.md): SourceCodester Online Polling System manage-admins.php sql injection (CVSS 6.9, SourceCodester Online Polling System)
- [CVE-2025-10081](https://cve.now/CVE-2025-10081.md): SourceCodester Pet Management System profile.php unrestricted upload (CVSS 5.1, SourceCodester Pet Management System)
- [CVE-2025-10080](https://cve.now/CVE-2025-10080.md): running-elephant Datart API AESUtil.java getTokensecret hard-coded key (CVSS 2.3, running-elephant Datart)
- [CVE-2025-10079](https://cve.now/CVE-2025-10079.md): PHPGurukul Small CRM get-quote.php sql injection (CVSS 6.9, PHPGurukul Small CRM)
- [CVE-2025-10078](https://cve.now/CVE-2025-10078.md): SourceCodester Online Polling System candidates.php sql injection (CVSS 6.9, SourceCodester Online Polling System)
- [CVE-2025-10077](https://cve.now/CVE-2025-10077.md): SourceCodester Online Polling System registeracc.php sql injection (CVSS 6.9, SourceCodester Online Polling System)
- [CVE-2025-10076](https://cve.now/CVE-2025-10076.md): SourceCodester Online Polling System manage-profile.php sql injection (CVSS 6.9, SourceCodester Online Polling System)
- [CVE-2025-10075](https://cve.now/CVE-2025-10075.md): SourceCodester Online Polling System manage-profile.php cross site scripting (CVSS 5.1, SourceCodester Online Polling System)
- [CVE-2025-10074](https://cve.now/CVE-2025-10074.md): Portabilis i-Educar tipos cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2022-50238](https://cve.now/CVE-2022-50238.md): The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. (CVSS 7.4, Microsoft Windows)
- [CVE-2024-48341](https://cve.now/CVE-2024-48341.md): dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShop (CVSS 3.7)
- [CVE-2025-22956](https://cve.now/CVE-2025-22956.md): OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. (CVSS 9.8)
- [CVE-2025-51586](https://cve.now/CVE-2025-51586.md): An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive in (CVSS 3.7, prestashop/prestashop)
- [CVE-2025-52161](https://cve.now/CVE-2025-52161.md): Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability. (CVSS 9.8)
- [CVE-2025-52288](https://cve.now/CVE-2025-52288.md): Assertion failure in function ngap\_build\_downlink\_nas\_transport in file src/amf/ngap-build.c, the Access and Mobility Management Function (A (CVSS 7.5)
- [CVE-2025-52389](https://cve.now/CVE-2025-52389.md): An Insecure Direct Object Reference (IDOR) in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attackers to access sensiti (CVSS 8.8)
- [CVE-2025-55849](https://cve.now/CVE-2025-55849.md): WeiPHP v5.0 and before is vulnerable to SQL Injection via the SucaiController.class.php file and the cancelTemplatee (CVSS 8.4)
- [CVE-2025-55998](https://cve.now/CVE-2025-55998.md): A cross-site scripting (XSS) vulnerability in Smart Search & Filter Shopify and BigCommerce apps allows a remote attacker to execute arbitra (CVSS 8.1)
- [CVE-2025-56265](https://cve.now/CVE-2025-56265.md): An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbi (CVSS 8.8, @n8n/n8n-nodes-langchain)
- [CVE-2025-56266](https://cve.now/CVE-2025-56266.md): A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. (CVSS 9.8)
- [CVE-2025-56267](https://cve.now/CVE-2025-56267.md): A CSV injection vulnerability in the /id\_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplyi (CVSS 9.8)
- [CVE-2025-56630](https://cve.now/CVE-2025-56630.md): FoxCMS v1.2.5 and before is vulnerable to SQL Injection via the column\_model parameter in the app/admin/controller/Column.php file. (CVSS 7.3)
- [CVE-2025-57141](https://cve.now/CVE-2025-57141.md): rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc. (CVSS 9.8)
- [CVE-2025-57285](https://cve.now/CVE-2025-57285.md): codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). (CVSS 9.8, codeceptjs)
- [CVE-2025-59033](https://cve.now/CVE-2025-59033.md): The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. (CVSS 7.4, Microsoft Windows)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.