# CVEs published 2025-09-14 36 CVEs were published on September 14, 2025: 1 critical, 3 high. Days are UTC. - [CVE-2025-10416](https://cve.now/CVE-2025-10416.md): Campcodes Grocery Sales and Inventory System ajax.php sql injection (CVSS 6.9, Campcodes Grocery Sales and Inventory System) - [CVE-2025-10415](https://cve.now/CVE-2025-10415.md): Campcodes Grocery Sales and Inventory System ajax.php sql injection (CVSS 6.9, Campcodes Grocery Sales and Inventory System) - [CVE-2025-10414](https://cve.now/CVE-2025-10414.md): Campcodes Grocery Sales and Inventory System ajax.php sql injection (CVSS 6.9, Campcodes Grocery Sales and Inventory System) - [CVE-2025-10413](https://cve.now/CVE-2025-10413.md): Campcodes Grocery Sales and Inventory System ajax.php sql injection (CVSS 6.9, Campcodes Grocery Sales and Inventory System) - [CVE-2025-10411](https://cve.now/CVE-2025-10411.md): itsourcecode E-Logbook with Health Monitoring System for COVID-19 POST Request check\_profile.php cross site scripting (CVSS 5.3, itsourcecode E-Logbook with Health Monitoring System for CO…) - [CVE-2025-10410](https://cve.now/CVE-2025-10410.md): SourceCodester Link Status Checker index.php server-side request forgery (CVSS 5.3, SourceCodester Link Status Checker) - [CVE-2025-10409](https://cve.now/CVE-2025-10409.md): SourceCodester Student Grading System rms.php sql injection (CVSS 5.3, SourceCodester Student Grading System) - [CVE-2025-10408](https://cve.now/CVE-2025-10408.md): SourceCodester Student Grading System edit\_user.php sql injection (CVSS 5.3, SourceCodester Student Grading System) - [CVE-2025-10407](https://cve.now/CVE-2025-10407.md): SourceCodester Student Grading System view\_user.php sql injection (CVSS 5.3, SourceCodester Student Grading System) - [CVE-2025-10405](https://cve.now/CVE-2025-10405.md): itsourcecode Baptism Information Management System listbaptism.php sql injection (CVSS 6.9, itsourcecode Baptism Information Management System) - [CVE-2025-10404](https://cve.now/CVE-2025-10404.md): itsourcecode Baptism Information Management System rptbaptismal.php sql injection (CVSS 6.9, itsourcecode Baptism Information Management System) - [CVE-2025-10403](https://cve.now/CVE-2025-10403.md): PHPGurukul Beauty Parlour Management System view-enquiry.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System) - [CVE-2025-6051](https://cve.now/CVE-2025-6051.md): Regular Expression Denial of Service (ReDoS) in huggingface/transformers (CVSS 5.3, huggingface/transformers · transformers) - [CVE-2025-10402](https://cve.now/CVE-2025-10402.md): PHPGurukul Beauty Parlour Management System readenq.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System) - [CVE-2025-10401](https://cve.now/CVE-2025-10401.md): D-Link DIR-823x diag\_ping command injection (CVSS 5.3, D-Link DIR-823x) - [CVE-2025-10400](https://cve.now/CVE-2025-10400.md): SourceCodester Food Ordering Management System ticket-message.php sql injection (CVSS 5.3, SourceCodester Food Ordering Management System) - [CVE-2025-10399](https://cve.now/CVE-2025-10399.md): Korzh EasyQuery Query Builder UI fetch sql injection (CVSS 5.3, Korzh EasyQuery) - [CVE-2025-0164](https://cve.now/CVE-2025-0164.md): IBM QRadar SIEM information disclosure (CVSS 2.3, IBM QRadar SIEM) - [CVE-2025-36035](https://cve.now/CVE-2025-36035.md): IBM PowerVM Hypervisor denial of service (CVSS 6.7, IBM PowerVM Hypervisor) - [CVE-2025-10204](https://cve.now/CVE-2025-10204.md): Unauth Admin Reset Password on AC Smart II (CVSS 7.1, LG Electronics AC Smart II) - [CVE-2025-10398](https://cve.now/CVE-2025-10398.md): fcba\_zzm ics-park Smart Park Management System FileUploadUtils.java unrestricted upload (CVSS 5.3, fcba\_zzm ics-park Smart Park Management System) - [CVE-2025-10397](https://cve.now/CVE-2025-10397.md): Magicblack MacCMS API server-side request forgery (CVSS 5.1, Magicblack MacCMS) - [CVE-2025-10396](https://cve.now/CVE-2025-10396.md): SourceCodester Pet Grooming Management Software edit\_role.php sql injection (CVSS 6.9, SourceCodester Pet Grooming Management Software) - [CVE-2025-10395](https://cve.now/CVE-2025-10395.md): Magicblack MacCMS Scheduled Task col\_url server-side request forgery (CVSS 5.1, Magicblack MacCMS) - [CVE-2025-10394](https://cve.now/CVE-2025-10394.md): fcba\_zzm ics-park Smart Park Management System Scheduled Task JobController.java code injection (CVSS 5.1, fcba\_zzm ics-park Smart Park Management System) - [CVE-2025-10393](https://cve.now/CVE-2025-10393.md): miurla morphic HTTP Status Code 3xx advanced-search fetchHtml server-side request forgery (CVSS 5.3, miurla morphic) - [CVE-2025-10392](https://cve.now/CVE-2025-10392.md): Mercury KM08-708H GiGA WiFi Wave2 HTTP Header stack-based overflow (CVSS 9.3, Mercury KM08-708H GiGA WiFi Wave2) - [CVE-2025-10391](https://cve.now/CVE-2025-10391.md): CRMEB OutAccountServices.php testOutUrl server-side request forgery (CVSS 5.3, CRMEB) - [CVE-2025-10390](https://cve.now/CVE-2025-10390.md): CRMEB UserAddressServices.php editAddress improper authorization (CVSS 5.3, CRMEB) - [CVE-2025-10389](https://cve.now/CVE-2025-10389.md): CRMEB Administrator Password SystemAdminServices.php save improper authorization (CVSS 5.3, CRMEB) - [CVE-2025-10388](https://cve.now/CVE-2025-10388.md): Selleo Mentingo Create New Course Basic Settings enroll-course cross site scripting (CVSS 5.1, Selleo Mentingo) - [CVE-2025-10387](https://cve.now/CVE-2025-10387.md): codesiddhant Jasmin Ransomware handshake.php sql injection (CVSS 5.3, codesiddhant Jasmin Ransomware) - [CVE-2025-10386](https://cve.now/CVE-2025-10386.md): Yida ECMS Consulting Enterprise Management System POST Request login.do cross site scripting (CVSS 5.3, Yida ECMS Consulting Enterprise Management System) - [CVE-2025-10385](https://cve.now/CVE-2025-10385.md): Mercury KM08-708H GiGA WiFi Wave2 mcr\_setSysAdm sub\_450B2C buffer overflow (CVSS 8.7, Mercury KM08-708H GiGA WiFi Wave2) - [CVE-2025-59363](https://cve.now/CVE-2025-59363.md): In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only (CVSS 7.7, One Identity OneLogin) - [CVE-2025-59364](https://cve.now/CVE-2025-59364.md): The express-xss-sanitizer (aka Express XSS Sanitizer) package through 2.0.0 for Node.js has an unbounded recursion depth in sanitize in lib/ (CVSS 5.3, Express XSS Sanitizer project Express XSS Sanitizer · expre…) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-09-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.