CVEs published September 14, 2025
36 CVEs were published on September 14, 2025: 1 critical, 3 high.
- Published
- 36
- Critical
- 1
- High
- 3
- Medium
- 31
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Campcodes Grocery Sales and Inventory System
- 4
- CRMEB
- 3
- SourceCodester Student Grading System
- 3
- fcba_zzm ics-park Smart Park Management System
- 2
- itsourcecode Baptism Information Management System
- 2
- Magicblack MacCMS
- 2
- Mercury KM08-708H GiGA WiFi Wave2
- 2
- PHPGurukul Beauty Parlour Management System
- 2
- codesiddhant Jasmin Ransomware
- 1
- D-Link DIR-823x
- 1
Critical 1
High 3
- CVE-2025-10204Unauth Admin Reset Password on AC Smart IILG Electronics AC Smart II
- CVE-2025-10385Mercury KM08-708H GiGA WiFi Wave2 mcr_setSysAdm sub_450B2C buffer overflowMercury KM08-708H GiGA WiFi Wave2
- CVE-2025-59363In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should onlyOne Identity OneLogin
Medium, low and unrated 32
- CVE-2025-10416Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10415Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10414Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10413Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10411itsourcecode E-Logbook with Health Monitoring System for COVID-19 POST Request check_profile.php cross site scriptingitsourcecode E-Logbook with Health Monitoring System for CO…
- CVE-2025-10410SourceCodester Link Status Checker index.php server-side request forgerySourceCodester Link Status Checker
- CVE-2025-10409SourceCodester Student Grading System rms.php sql injectionSourceCodester Student Grading System
- CVE-2025-10408SourceCodester Student Grading System edit_user.php sql injectionSourceCodester Student Grading System
- CVE-2025-10407SourceCodester Student Grading System view_user.php sql injectionSourceCodester Student Grading System
- CVE-2025-10405itsourcecode Baptism Information Management System listbaptism.php sql injectionitsourcecode Baptism Information Management System
- CVE-2025-10404itsourcecode Baptism Information Management System rptbaptismal.php sql injectionitsourcecode Baptism Information Management System
- CVE-2025-10403PHPGurukul Beauty Parlour Management System view-enquiry.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-6051Regular Expression Denial of Service (ReDoS) in huggingface/transformershuggingface/transformers · transformers
- CVE-2025-10402PHPGurukul Beauty Parlour Management System readenq.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-10401D-Link DIR-823x diag_ping command injectionD-Link DIR-823x
- CVE-2025-10400SourceCodester Food Ordering Management System ticket-message.php sql injectionSourceCodester Food Ordering Management System
- CVE-2025-10399Korzh EasyQuery Query Builder UI fetch sql injectionKorzh EasyQuery
- CVE-2025-0164IBM QRadar SIEM information disclosureIBM QRadar SIEM
- CVE-2025-36035IBM PowerVM Hypervisor denial of serviceIBM PowerVM Hypervisor
- CVE-2025-10398fcba_zzm ics-park Smart Park Management System FileUploadUtils.java unrestricted uploadfcba_zzm ics-park Smart Park Management System
- CVE-2025-10397Magicblack MacCMS API server-side request forgeryMagicblack MacCMS
- CVE-2025-10396SourceCodester Pet Grooming Management Software edit_role.php sql injectionSourceCodester Pet Grooming Management Software
- CVE-2025-10395Magicblack MacCMS Scheduled Task col_url server-side request forgeryMagicblack MacCMS
- CVE-2025-10394fcba_zzm ics-park Smart Park Management System Scheduled Task JobController.java code injectionfcba_zzm ics-park Smart Park Management System
- CVE-2025-10393miurla morphic HTTP Status Code 3xx advanced-search fetchHtml server-side request forgerymiurla morphic
- CVE-2025-10391CRMEB OutAccountServices.php testOutUrl server-side request forgeryCRMEB
- CVE-2025-10390CRMEB UserAddressServices.php editAddress improper authorizationCRMEB
- CVE-2025-10389CRMEB Administrator Password SystemAdminServices.php save improper authorizationCRMEB
- CVE-2025-10388Selleo Mentingo Create New Course Basic Settings enroll-course cross site scriptingSelleo Mentingo
- CVE-2025-10387codesiddhant Jasmin Ransomware handshake.php sql injectioncodesiddhant Jasmin Ransomware
- CVE-2025-10386Yida ECMS Consulting Enterprise Management System POST Request login.do cross site scriptingYida ECMS Consulting Enterprise Management System
- CVE-2025-59364The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/Express XSS Sanitizer project Express XSS Sanitizer · expre…