# CVEs published 2025-09-20

15 CVEs were published on September 20, 2025: 1 critical, 2 high. Days are UTC.

- [CVE-2025-10757](https://cve.now/CVE-2025-10757.md): UTT 1200GW formConfigDnsFilterGlobal buffer overflow (CVSS 8.7, UTT 1200GW)
- [CVE-2025-10756](https://cve.now/CVE-2025-10756.md): UTT HiPER 840G getOneApConfTempEntry buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2025-10755](https://cve.now/CVE-2025-10755.md): Selleo Mentingo Content-Type unrestricted upload (CVSS 5.3, Selleo Mentingo)
- [CVE-2025-40925](https://cve.now/CVE-2025-40925.md): Starch versions 0.14 and earlier generate session ids insecurely (CVSS 9.1, BLUEFEET Starch)
- [CVE-2025-10741](https://cve.now/CVE-2025-10741.md): Selleo Mentingo Profile Picture unrestricted upload (CVSS 5.3, Selleo Mentingo)
- [CVE-2025-9887](https://cve.now/CVE-2025-9887.md): Custom Login And Signup Widget \<= 1.0 - Cross-Site Request Forgery (CVSS 4.3, bittokazi Custom Login And Signup Widget)
- [CVE-2025-9883](https://cve.now/CVE-2025-9883.md): Browser Sniff \<= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, bpedrassani Browser Sniff)
- [CVE-2025-9882](https://cve.now/CVE-2025-9882.md): osTicket WP Bridge \<= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, michaelbo osTicket WP Bridge)
- [CVE-2025-10658](https://cve.now/CVE-2025-10658.md): SupportCandy – Helpdesk & Customer Support Ticket System \<= 3.3.7 - Authentication Bypass to Support Session Takeover (CVSS 6.5, psmplugins SupportCandy – Helpdesk & Customer Support Ticke…)
- [CVE-2025-9949](https://cve.now/CVE-2025-9949.md): Internal Links Manager \<= 3.0.1 - Cross-Site Request Forgery (CVSS 4.3, webraketen Internal Links Manager)
- [CVE-2025-10002](https://cve.now/CVE-2025-10002.md): ClickWhale \<= 2.5.0 - Authenticated (Admin+) SQL injection (CVSS 4.9, ClickWhale – Link Manager, Link Shortener and Click Tracker…)
- [CVE-2025-10305](https://cve.now/CVE-2025-10305.md): Secure Passkeys \<= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion (CVSS 5.3, endisha Secure Passkeys)
- [CVE-2025-10489](https://cve.now/CVE-2025-10489.md): SureForms – Drag and Drop Form Builder for WordPress \<= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation (CVSS 4.3, brainstormforce SureForms – Contact Form, Payment Form & Ot…)
- [CVE-2025-10181](https://cve.now/CVE-2025-10181.md): Draft List \<= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dartiss Draft List)
- [CVE-2025-10652](https://cve.now/CVE-2025-10652.md): Robcore Netatmo \<= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode (CVSS 6.5, robcore89 Robcore Netatmo)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.