# CVEs published 2025-09-11 155 CVEs were published on September 11, 2025: 13 critical, 35 high. Days are UTC. - [CVE-2025-10273](https://cve.now/CVE-2025-10273.md): erjinzhi 10OA file.aspx path traversal (CVSS 5.1, erjinzhi 10OA) - [CVE-2025-10272](https://cve.now/CVE-2025-10272.md): erjinzhi 10OA catalogue cross site scripting (CVSS 5.3, erjinzhi 10OA) - [CVE-2025-10271](https://cve.now/CVE-2025-10271.md): erjinzhi 10OA finder cross site scripting (CVSS 5.3, erjinzhi 10OA) - [CVE-2025-36222](https://cve.now/CVE-2025-36222.md): IBM Fusion insecure default configuration (CVSS 8.7, IBM Fusion) - [CVE-2025-10127](https://cve.now/CVE-2025-10127.md): Daikin Europe N.V Security Gateway Weak Password Recovery Mechanism for Forgotten Password (CVSS 9.8, Daikin Europe N.V Security Gateway) - [CVE-2025-59055](https://cve.now/CVE-2025-59055.md): InstantCMS vulnerable to Server-Side Request Forgery via package installer (CVSS 4.7, instantsoft icms2) - [CVE-2025-8061](https://cve.now/CVE-2025-8061.md): A potential insufficient access control vulnerability was reported in the Lenovo Dispatcher 3.0 and Dispatcher 3.1 drivers used by some Leno (CVSS 7.3, Lenovo Dispatcher 3.0 Driver · Lenovo Dispatcher 3.1 Driver) - [CVE-2025-8557](https://cve.now/CVE-2025-8557.md): An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a (CVSS 8.7, Lenovo XClarity Orchestrator) - [CVE-2025-9214](https://cve.now/CVE-2025-9214.md): A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or mo (CVSS 5.3, Lenovo LJ2206W Printer · Lenovo M7206W Printer +10) - [CVE-2025-9319](https://cve.now/CVE-2025-9319.md): A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions. (CVSS 7.5, Lenovo Wallpaper Client) - [CVE-2025-9201](https://cve.now/CVE-2025-9201.md): A potential DLL hijacking vulnerability was discovered in Lenovo Browser during an internal security assessment that could allow a local use (CVSS 8.5, Lenovo Browser) - [CVE-2025-59053](https://cve.now/CVE-2025-59053.md): AIRI's character card/chat UI is vulnerable to XSS and can lead to RCE (CVSS 9.7, moeru-ai airi) - [CVE-2025-59047](https://cve.now/CVE-2025-59047.md): matrix-sdk-base has panic in the \`RoomMember::normalized\_power\_level()\` method (CVSS 2.7, matrix-org matrix-rust-sdk · matrix-sdk-base) - [CVE-2025-58065](https://cve.now/CVE-2025-58065.md): Flask App Builder has an Authentication Bypass vulnerability when using non AUTH\_DB methods (CVSS 6.5, dpgaspar Flask-AppBuilder · flask-appbuilder) - [CVE-2025-43790](https://cve.now/CVE-2025-43790.md): Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6 (CVSS 7.4, Liferay Portal · Liferay DXP +1) - [CVE-2025-43782](https://cve.now/CVE-2025-43782.md): Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.7 (CVSS 5.3, Liferay Portal · Liferay DXP +1) - [CVE-2025-58364](https://cve.now/CVE-2025-58364.md): cups: Remote DoS via null dereference (CVSS 6.5, OpenPrinting cups) - [CVE-2025-58060](https://cve.now/CVE-2025-58060.md): cups has Authentication bypass with AuthType Negotiate (CVSS 8.0, OpenPrinting cups) - [CVE-2025-39791](https://cve.now/CVE-2025-39791.md): dm: dm-crypt: Do not partially accept write BIOs with zoned targets (CVSS 7.8, Linux) - [CVE-2025-39790](https://cve.now/CVE-2025-39790.md): bus: mhi: host: Detect events pointing to unexpected TREs (CVSS 8.4, Linux) - [CVE-2025-39789](https://cve.now/CVE-2025-39789.md): crypto: x86/aegis - Add missing error checks (CVSS 7.3, Linux) - [CVE-2025-39788](https://cve.now/CVE-2025-39788.md): scsi: ufs: exynos: Fix programming of HCI\_UTRL\_NEXUS\_TYPE (no CVSS, Linux) - [CVE-2025-39787](https://cve.now/CVE-2025-39787.md): soc: qcom: mdt\_loader: Ensure we don't read past the ELF header (CVSS 7.8, Linux) - [CVE-2025-39786](https://cve.now/CVE-2025-39786.md): iio: adc: ad7173: fix channels index for syscalib\_mode (CVSS 7.8, Linux) - [CVE-2025-39785](https://cve.now/CVE-2025-39785.md): drm/hisilicon/hibmc: fix irq\_request()'s irq name variable is local (CVSS 7.8, Linux) - [CVE-2025-39784](https://cve.now/CVE-2025-39784.md): PCI: Fix link speed calculation on retrain failure (no CVSS, Linux) - [CVE-2025-39783](https://cve.now/CVE-2025-39783.md): PCI: endpoint: Fix configfs group list head handling (no CVSS, Linux) - [CVE-2025-39782](https://cve.now/CVE-2025-39782.md): jbd2: prevent softlockup in jbd2\_log\_do\_checkpoint() (no CVSS, Linux) - [CVE-2025-39781](https://cve.now/CVE-2025-39781.md): parisc: Drop WARN\_ON\_ONCE() from flush\_cache\_vmap (no CVSS, Linux) - [CVE-2025-39780](https://cve.now/CVE-2025-39780.md): sched/ext: Fix invalid task state transitions on class switch (CVSS 7.8, Linux) - [CVE-2025-39779](https://cve.now/CVE-2025-39779.md): btrfs: subpage: keep TOWRITE tag until folio is cleaned (CVSS 7.8, Linux) - [CVE-2025-39777](https://cve.now/CVE-2025-39777.md): crypto: acomp - Fix CFI failure due to type punning (no CVSS, Linux) - [CVE-2025-39776](https://cve.now/CVE-2025-39776.md): mm/debug\_vm\_pgtable: clear page table entries at destroy\_args() (CVSS 7.0, Linux) - [CVE-2025-39775](https://cve.now/CVE-2025-39775.md): mm/mremap: fix WARN with uffd that has remap events disabled (no CVSS, Linux) - [CVE-2025-39774](https://cve.now/CVE-2025-39774.md): iio: adc: rzg2l\_adc: Set driver data before enabling runtime PM (no CVSS, Linux) - [CVE-2025-39773](https://cve.now/CVE-2025-39773.md): net: bridge: fix soft lockup in br\_multicast\_query\_expired() (no CVSS, Linux) - [CVE-2025-39772](https://cve.now/CVE-2025-39772.md): drm/hisilicon/hibmc: fix the hibmc loaded failed bug (no CVSS, Linux) - [CVE-2025-39771](https://cve.now/CVE-2025-39771.md): regulator: pca9450: Use devm\_register\_sys\_off\_handler (no CVSS, Linux) - [CVE-2025-39770](https://cve.now/CVE-2025-39770.md): net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6\_CSUM (CVSS 7.5, Linux) - [CVE-2025-39769](https://cve.now/CVE-2025-39769.md): bnxt\_en: Fix lockdep warning during rmmod (no CVSS, Linux) - [CVE-2025-39768](https://cve.now/CVE-2025-39768.md): net/mlx5: HWS, fix complex rules rehash error flow (no CVSS, Linux) - [CVE-2025-39767](https://cve.now/CVE-2025-39767.md): LoongArch: Optimize module load time by optimizing PLT/GOT counting (no CVSS, Linux) - [CVE-2025-39766](https://cve.now/CVE-2025-39766.md): net/sched: Make cake\_enqueue return NET\_XMIT\_CN when past buffer\_limit (no CVSS, Linux) - [CVE-2025-39765](https://cve.now/CVE-2025-39765.md): ALSA: timer: fix ida\_free call while not allocated (no CVSS, Linux) - [CVE-2025-39764](https://cve.now/CVE-2025-39764.md): netfilter: ctnetlink: remove refcounting in expectation dumpers (no CVSS, Linux) - [CVE-2025-39763](https://cve.now/CVE-2025-39763.md): ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered (no CVSS, Linux) - [CVE-2025-39762](https://cve.now/CVE-2025-39762.md): drm/amd/display: add null check (no CVSS, Linux) - [CVE-2025-39761](https://cve.now/CVE-2025-39761.md): wifi: ath12k: Decrement TID on RX peer frag setup error handling (CVSS 8.8, Linux) - [CVE-2025-39760](https://cve.now/CVE-2025-39760.md): usb: core: config: Prevent OOB read in SS endpoint companion parsing (no CVSS, Linux) - [CVE-2025-39759](https://cve.now/CVE-2025-39759.md): btrfs: qgroup: fix race between quota disable and quota rescan ioctl (no CVSS, Linux) - [CVE-2025-39758](https://cve.now/CVE-2025-39758.md): RDMA/siw: Fix the sendmsg byte count in siw\_tcp\_sendpages (CVSS 9.8, Linux) - [CVE-2025-39757](https://cve.now/CVE-2025-39757.md): ALSA: usb-audio: Validate UAC3 cluster segment descriptors (no CVSS, Linux) - [CVE-2025-39756](https://cve.now/CVE-2025-39756.md): fs: Prevent file descriptor table allocations exceeding INT\_MAX (no CVSS, Linux) - [CVE-2025-39754](https://cve.now/CVE-2025-39754.md): mm/smaps: fix race between smaps\_hugetlb\_range and migration (no CVSS, Linux) - [CVE-2025-39753](https://cve.now/CVE-2025-39753.md): gfs2: Set .migrate\_folio in gfs2\_{rgrp,meta}\_aops (no CVSS, Linux) - [CVE-2025-39752](https://cve.now/CVE-2025-39752.md): ARM: rockchip: fix kernel hang during smp initialization (no CVSS, Linux) - [CVE-2025-39750](https://cve.now/CVE-2025-39750.md): wifi: ath12k: Correct tid cleanup when tid setup fails (CVSS 8.8, Linux) - [CVE-2025-39749](https://cve.now/CVE-2025-39749.md): rcu: Protect -\>defer\_qs\_iw\_pending from data race (no CVSS, Linux) - [CVE-2025-39748](https://cve.now/CVE-2025-39748.md): bpf: Forget ranges when refining tnum after JSET (no CVSS, Linux) - [CVE-2025-39747](https://cve.now/CVE-2025-39747.md): drm/msm: Add error handling for krealloc in metadata setup (no CVSS, Linux) - [CVE-2025-39746](https://cve.now/CVE-2025-39746.md): wifi: ath10k: shutdown driver when hardware is unreliable (no CVSS, Linux) - [CVE-2025-39745](https://cve.now/CVE-2025-39745.md): rcutorture: Fix rcutorture\_one\_extend\_check() splat in RT kernels (no CVSS, Linux) - [CVE-2025-39744](https://cve.now/CVE-2025-39744.md): rcu: Fix rcu\_read\_unlock() deadloop due to IRQ work (no CVSS, Linux) - [CVE-2025-39743](https://cve.now/CVE-2025-39743.md): jfs: truncate good inode pages when hard link is 0 (no CVSS, Linux) - [CVE-2025-39742](https://cve.now/CVE-2025-39742.md): RDMA: hfi1: fix possible divide-by-zero in find\_hw\_thread\_mask() (no CVSS, Linux) - [CVE-2025-39741](https://cve.now/CVE-2025-39741.md): drm/xe/migrate: don't overflow max copy size (no CVSS, Linux) - [CVE-2025-39740](https://cve.now/CVE-2025-39740.md): drm/xe/migrate: prevent potential UAF (CVSS 7.8, Linux) - [CVE-2025-39739](https://cve.now/CVE-2025-39739.md): iommu/arm-smmu-qcom: Add SM6115 MDSS compatible (no CVSS, Linux) - [CVE-2025-39738](https://cve.now/CVE-2025-39738.md): btrfs: do not allow relocation of partially dropped subvolumes (CVSS 7.3, Linux) - [CVE-2025-39737](https://cve.now/CVE-2025-39737.md): mm/kmemleak: avoid soft lockup in \_\_kmemleak\_do\_cleanup() (no CVSS, Linux) - [CVE-2025-39736](https://cve.now/CVE-2025-39736.md): mm/kmemleak: avoid deadlock by moving pr\_warn() outside kmemleak\_lock (no CVSS, Linux) - [CVE-2025-40300](https://cve.now/CVE-2025-40300.md): x86/vmscape: Add conditional IBPB mitigation (no CVSS, Linux) - [CVE-2025-26499](https://cve.now/CVE-2025-26499.md): Under heavy system utilization a random race condition can occur during authentication or token refresh operation. (CVSS 6.0, Wind River Studio Developer) - [CVE-2025-10255](https://cve.now/CVE-2025-10255.md): Ascensio System SIA OnlyOffice Comment Messages.aspx cross site scripting (CVSS 5.1, Ascensio System SIA OnlyOffice) - [CVE-2025-10254](https://cve.now/CVE-2025-10254.md): Ascensio System SIA OnlyOffice SVG Image Messages.aspx cross site scripting (CVSS 5.1, Ascensio System SIA OnlyOffice) - [CVE-2025-58145](https://cve.now/CVE-2025-58145.md): Arm issues with page refcounting (CVSS 7.5, Xen) - [CVE-2025-58144](https://cve.now/CVE-2025-58144.md): Arm issues with page refcounting (CVSS 7.5, Xen) - [CVE-2025-10193](https://cve.now/CVE-2025-10193.md): Neo4j Cypher MCP server is vulnerable to DNS rebinding attacks (CVSS 7.4, neo4j-cypher MCP server · mcp-neo4j-cypher) - [CVE-2025-58143](https://cve.now/CVE-2025-58143.md): Mutiple vulnerabilities in the Viridian interface (CVSS 9.8, Xen) - [CVE-2025-58142](https://cve.now/CVE-2025-58142.md): Mutiple vulnerabilities in the Viridian interface (CVSS 9.8, Xen) - [CVE-2025-27466](https://cve.now/CVE-2025-27466.md): Mutiple vulnerabilities in the Viridian interface (CVSS 9.8, Xen) - [CVE-2025-10253](https://cve.now/CVE-2025-10253.md): openDCIM SVG File uploadifive.php cross site scripting (CVSS 5.1, openDCIM) - [CVE-2025-8716](https://cve.now/CVE-2025-8716.md): Cache exploitation vulnerability (CVSS 5.8, OpenText Content Management) - [CVE-2025-10252](https://cve.now/CVE-2025-10252.md): SEAT Queue Ticket Kiosk Java RMI Registry deserialization (CVSS 2.3, SEAT Queue Ticket Kiosk) - [CVE-2025-10251](https://cve.now/CVE-2025-10251.md): FoxCMS Images.php batchCope sql injection (CVSS 5.3, FoxCMS) - [CVE-2025-40696](https://cve.now/CVE-2025-40696.md): Cross Site Scripting in PHPGurukul Online Fire Reporting System (CVSS 5.1, PHPGurukul Online Fire Reporting System) - [CVE-2025-40695](https://cve.now/CVE-2025-40695.md): Cross Site Scripting in PHPGurukul Online Fire Reporting System (CVSS 5.1, PHPGurukul Online Fire Reporting System) - [CVE-2025-40694](https://cve.now/CVE-2025-40694.md): Cross Site Scripting in PHPGurukul Online Fire Reporting System (CVSS 5.1, PHPGurukul Online Fire Reporting System) - [CVE-2025-40693](https://cve.now/CVE-2025-40693.md): Cross Site Scripting in PHPGurukul Online Fire Reporting System (CVSS 5.1, PHPGurukul Online Fire Reporting System) - [CVE-2025-10250](https://cve.now/CVE-2025-10250.md): DJI Mavic Spark/Mavic Air/Mavic Mini Telemetry Channel hard-coded key (CVSS 2.3, DJI Mavic Spark · DJI Mavic Air +1) - [CVE-2025-40692](https://cve.now/CVE-2025-40692.md): SQL injection in PHPGurukul Online Fire Reporting System (CVSS 9.3, PHPGurukul Online Fire Reporting System) - [CVE-2025-40691](https://cve.now/CVE-2025-40691.md): SQL injection in PHPGurukul Online Fire Reporting System (CVSS 9.3, PHPGurukul Online Fire Reporting System) - [CVE-2025-40690](https://cve.now/CVE-2025-40690.md): SQL injection in PHPGurukul Online Fire Reporting System (CVSS 9.3, PHPGurukul Online Fire Reporting System) - [CVE-2025-40689](https://cve.now/CVE-2025-40689.md): SQL injection in PHPGurukul Online Fire Reporting System (CVSS 9.3, PHPGurukul Online Fire Reporting System) - [CVE-2025-40687](https://cve.now/CVE-2025-40687.md): SQL injection in PHPGurukul Online Fire Reporting System (CVSS 9.3, PHPGurukul Online Fire Reporting System) - [CVE-2025-9018](https://cve.now/CVE-2025-9018.md): Time Tracker \<= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Limited Data Deletion (CVSS 8.8, germanpearls Time Tracker) - [CVE-2025-58320](https://cve.now/CVE-2025-58320.md): DIALink - Directory Traversal Authentication Bypass Vulnerability (CVSS 7.3, Delta Electronics DIALink) - [CVE-2025-58321](https://cve.now/CVE-2025-58321.md): DIALink - Directory Traversal Authentication Bypass Vulnerability (CVSS 10.0, Delta Electronics DIALink) - [CVE-2025-48041](https://cve.now/CVE-2025-48041.md): SSH\_FXP\_OPENDIR may Lead to Exhaustion of File Handles (CVSS 7.1, Erlang OTP) - [CVE-2025-48040](https://cve.now/CVE-2025-48040.md): Malicious Key Exchange Messages may Lead to Excessive Resource Consumption (CVSS 6.9, Erlang OTP) - [CVE-2025-48039](https://cve.now/CVE-2025-48039.md): Unverified Paths can Cause Excessive Use of System Resources (CVSS 5.3, Erlang OTP) - [CVE-2025-48038](https://cve.now/CVE-2025-48038.md): Unverified File Handles can Cause Excessive Use of System Resources (CVSS 5.3, Erlang OTP) - [CVE-2025-9918](https://cve.now/CVE-2025-9918.md): Zip Slip in Google SecOps SOAR allows for Remote Code Execution (CVSS 8.7, Google Cloud Google SecOps SOAR) - [CVE-2025-9633](https://cve.now/CVE-2025-9633.md): LH Signing \<= 2.83 - Cross-Site Request Forgery (CVSS 4.3, shawfactor LH Signing) - [CVE-2025-8691](https://cve.now/CVE-2025-8691.md): WP Scriptcase \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter (CVSS 6.4, softmus WP Scriptcase) - [CVE-2025-8398](https://cve.now/CVE-2025-8398.md): azurecurve BBCode \<= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Shortcode (CVSS 6.4, azurecurve BBCode) - [CVE-2025-9855](https://cve.now/CVE-2025-9855.md): Enhanced BibliPlug \<= 1.3.8 - Authenticated (Contirbutor+) Stored Cross-Site Scripting (CVSS 6.4, zuotian Enhanced BibliPlug) - [CVE-2025-8425](https://cve.now/CVE-2025-8425.md): My WP Translate \<= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, mythemeshop My WP Translate) - [CVE-2025-9123](https://cve.now/CVE-2025-9123.md): CBX Map for Google Map & OpenStreetMap \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, manchumahara CBX Map for Google Map & OpenStreetMap) - [CVE-2025-9632](https://cve.now/CVE-2025-9632.md): PhpList Subber \<= 1.1 - Cross-Site Request Forgery (CVSS 4.3, vinzzb PhpList Subber) - [CVE-2025-9617](https://cve.now/CVE-2025-9617.md): Publish approval \<= 1.1 - Cross-Site Request Forgery (CVSS 5.3, evidentlycube Publish approval) - [CVE-2025-9128](https://cve.now/CVE-2025-9128.md): eID Easy \<= 4.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, eideasy eID Easy) - [CVE-2025-9693](https://cve.now/CVE-2025-9693.md): User Meta – User Profile Builder and User management plugin \<= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.0, khaledsaikat User Meta – User Profile Builder and User mana…) - [CVE-2025-9620](https://cve.now/CVE-2025-9620.md): Seo Monster \<= 3.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, edsteep Seo Monster) - [CVE-2025-8570](https://cve.now/CVE-2025-8570.md): BeyondCart Connector \<= 3.0.1 - Missing Configuration of JWT Secret to Unauthenticated Privilege Escalation via determine\_current\_user Filter (CVSS 9.8, BeyondCart Connector) - [CVE-2025-9451](https://cve.now/CVE-2025-9451.md): Smartcat Translator for WPML \<= 3.1.72 - Authenticated (Author+) SQL Injection via orderby Parameter (CVSS 6.5, smartcatai Smartcat Translator for WPML) - [CVE-2025-8689](https://cve.now/CVE-2025-8689.md): Elements Plus! \<= 2.16.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, cssigniterteam Elements Plus!) - [CVE-2025-8215](https://cve.now/CVE-2025-8215.md): Responsive Addons for Elementor \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (CVSS 6.4, cyberchimps Responsive Addons for Elementor – Free Elemento…) - [CVE-2025-8481](https://cve.now/CVE-2025-8481.md): Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid \<= 1.1.7 - Cross-Site Request Forgery (CVSS 4.3, mdimran41 Blog Designer For Elementor – Post Slider, Post C…) - [CVE-2025-9623](https://cve.now/CVE-2025-9623.md): Admin in English with Switch \<= 1.1 - Cross-Site Request Forgery (CVSS 4.3, dontcare Admin in English with Switch) - [CVE-2025-8392](https://cve.now/CVE-2025-8392.md): Mitfahrgelegenheit \<= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter (CVSS 6.4, bessermitfahren Mitfahrgelegenheit) - [CVE-2025-8492](https://cve.now/CVE-2025-8492.md): Salon Booking System \<= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution (CVSS 5.3, wordpresschef Salon Booking System – Free Version) - [CVE-2025-9627](https://cve.now/CVE-2025-9627.md): Run Log \<= 1.7.10 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, izem Run Log) - [CVE-2025-9860](https://cve.now/CVE-2025-9860.md): Mixtape \<= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, natata7 Mixtape) - [CVE-2025-9874](https://cve.now/CVE-2025-9874.md): Ultimate Classified Listings \<= 1.6 - Authenticated (Contributor+) Local File Inclusion (CVSS 7.5, webcodingplace Ultimate Classified Listings) - [CVE-2025-9635](https://cve.now/CVE-2025-9635.md): Analytics Reduce Bounce Rate \<= 2.3 - Cross-Site Request Forgery (CVSS 4.3, ishan001 Analytics Reduce Bounce Rate) - [CVE-2025-9634](https://cve.now/CVE-2025-9634.md): Plugin updates blocker \<= 0.2 - Cross-Site Request Forgery (CVSS 4.3, jegerwan Plugin updates blocker) - [CVE-2025-8318](https://cve.now/CVE-2025-8318.md): Jobify \<= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via keyword Parameter (CVSS 6.4, bmarshall511 Jobify) - [CVE-2025-8423](https://cve.now/CVE-2025-8423.md): My WP Translate \<= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion (CVSS 5.4, mythemeshop My WP Translate) - [CVE-2025-8692](https://cve.now/CVE-2025-8692.md): Coupon API \<= 6.2.12 - Authenticated (Administrator+) SQL Injection via 'log\_duration' (CVSS 4.9, kamilkhan Coupon API) - [CVE-2025-9073](https://cve.now/CVE-2025-9073.md): All in one Minifier \<= 3.2 - Unauthenticated SQL Injection (CVSS 7.5, maheshmthorat All in one Minifier) - [CVE-2025-8445](https://cve.now/CVE-2025-8445.md): Countdown Timer for Elementor \<= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown\_label' (CVSS 6.4, shaikhaezaz80 Countdown Timer for Elementor) - [CVE-2025-5801](https://cve.now/CVE-2025-5801.md): Digital Events Calendar \<= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via column Parameter (CVSS 6.4, rejuancse Digital Events Calendar) - [CVE-2025-8417](https://cve.now/CVE-2025-8417.md): Catalog Importer, Scraper & Crawler \<= 5.1.4 - Unauthenticated PHP Code Injection (CVSS 8.1, idiatech Catalog Importer, Scraper & Crawler) - [CVE-2025-8422](https://cve.now/CVE-2025-8422.md): Propovoice \<= 1.7.6.7 - Unauthenticated Arbitrary File Read (CVSS 7.5, fassionstorage Propovoice: All-in-One Client Management Sys…) - [CVE-2025-9850](https://cve.now/CVE-2025-9850.md): Evenium \<= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Evenium) - [CVE-2025-9628](https://cve.now/CVE-2025-9628.md): The integration of the AMO.CRM \<= 1.0.1 - Cross-Site Request Forgery (CVSS 4.3, jh5ru The integration of the AMO.CRM) - [CVE-2025-9861](https://cve.now/CVE-2025-9861.md): ThemeLoom Widgets \<= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, livingos ThemeLoom Widgets) - [CVE-2025-8686](https://cve.now/CVE-2025-8686.md): WP Easy FAQs \<= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via WP\_EASY\_FAQ Shortcode (CVSS 6.4, wen-solutions WP Easy FAQs) - [CVE-2025-0763](https://cve.now/CVE-2025-0763.md): Ultimate Classified Listings \<= 1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (CVSS 4.3, webcodingplace Ultimate Classified Listings) - [CVE-2025-8316](https://cve.now/CVE-2025-8316.md): Certifica WP \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via evento Parameter (CVSS 6.4, moreirapontocom Certifica WP) - [CVE-2025-9631](https://cve.now/CVE-2025-9631.md): AutoCatSet \<= 2.1.4 - Cross-Site Request Forgery (CVSS 4.3, gyaku AutoCatSet) - [CVE-2025-8721](https://cve.now/CVE-2025-8721.md): Workable API \<= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via workable\_jobs Shortcode (CVSS 6.4, miriamgoldman Workable Api) - [CVE-2025-8479](https://cve.now/CVE-2025-8479.md): Zoho Flow \<= 2.14.1 - Cross-Site Request Forgery (CVSS 4.3, zohoflow Zoho Flow – Integrate 100+ plugins with 1000+ busi…) - [CVE-2025-9034](https://cve.now/CVE-2025-9034.md): Wp Edit Password Protected \< 1.3.5 - Open Redirect (CVSS 6.1, Wp Edit Password Protected) - [CVE-2025-10247](https://cve.now/CVE-2025-10247.md): JEPaaS Filter doFilterInternal access control (CVSS 5.3, JEPaaS) - [CVE-2025-9059](https://cve.now/CVE-2025-9059.md): Elevation of Privileges Vulnerability in IT Management Suite (CVSS 8.8, Broadcom 8.6.IT Management Suite) - [CVE-2025-10246](https://cve.now/CVE-2025-10246.md): lokibhardwaj PHP-Code-For-Unlimited-File-Upload f.php cross site scripting (CVSS 5.1, lokibhardwaj PHP-Code-For-Unlimited-File-Upload) - [CVE-2025-9910](https://cve.now/CVE-2025-9910.md): Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. (CVSS 2.3, jsondiffpatch · org.webjars.npm:jsondiffpatch +1) - [CVE-2025-9776](https://cve.now/CVE-2025-9776.md): CatFolders – Tame Your WordPress Media Library by Category \<= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import (CVSS 6.5, CatFolders – WordPress Media Library Folders & Categories) - [CVE-2025-10245](https://cve.now/CVE-2025-10245.md): Display Painéis TGA Galeria rename path traversal (CVSS 4.8, Display Painéis TGA) - [CVE-2025-10236](https://cve.now/CVE-2025-10236.md): binary-husky gpt\_academic LaTeX File latex\_toolbox.py merge\_tex\_files\_ path traversal (CVSS 5.3, binary-husky gpt\_academic) - [CVE-2025-6088](https://cve.now/CVE-2025-6088.md): Improper Authorization in danny-avila/librechat (CVSS 4.2, danny-avila/librechat) - [CVE-2025-10235](https://cve.now/CVE-2025-10235.md): Scada-LTS Reports reports.shtm cross site scripting (CVSS 4.8, Scada-LTS) - [CVE-2025-56556](https://cve.now/CVE-2025-56556.md): An issue was discovered in Subrion CMS 4.2.1, allowing authenticated adminitrators or moderators with access to the built-in Run SQL Query f (CVSS 3.8, intelliants/subrion) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-09-11 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.