CVEs published September 27, 2025
53 CVEs were published on September 27, 2025: 1 critical, 7 high.
- Published
- 53
- Critical
- 1
- High
- 7
- Medium
- 44
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Campcodes Online Learning Management System
- 7
- GNU Binutils
- 3
- itsourcecode Open Source Job Portal
- 3
- IBM Storage TS4500 Library
- 2
- kstover Ninja Forms – The Contact Form Builder That Grows W…
- 2
- Portabilis i-Educar
- 2
- SourceCodester Pet Grooming Management Software
- 2
- westboy CicadasCMS
- 2
- algoliasearch-helper
- 1
- Campcodes Farm Management System
- 1
Critical 1
High 7
- CVE-2025-7647Insecure Temporary File Handling in run-llama/llama_indexrun-llama/llama_index · llama-index-core
- CVE-2025-8014Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-3193Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the _merge() functionalgoliasearch-helper
- CVE-2025-9816WP Statistics <= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Headerveronalabs WP Statistics – Simple, privacy-friendly Google…
- CVE-2025-59945SysReptor Susceptible to Privilege Escalation by Authenticated UsersSyslifters sysreptor
- CVE-2025-59932FlagForgeCTF Unauthenticated Resource Modification/DeletionFlagForgeCTF flagForge
- CVE-2025-59939WeGIA vulnerable to SQL Injection into method `excluir` of the `ProdutoControle` class in the parameter `id_produto`.LabRedesCefetRJ WeGIA
Medium, low and unrated 45
- CVE-2025-11088itsourcecode Open Source Job Portal index.php sql injectionitsourcecode Open Source Job Portal
- CVE-2025-11083GNU Binutils Linker elfcode.h elf_swap_shdr heap-based overflowGNU Binutils
- CVE-2025-11082GNU Binutils Linker elf-eh-frame.c _bfd_elf_parse_eh_frame heap-based overflowGNU Binutils
- CVE-2025-11081GNU Binutils objdump.c dump_dwarf_section out-of-boundsGNU Binutils
- CVE-2025-11080zhuimengshaonian wisdom-education ExamInfoController.java selectStudentExamInfoList improper authorizationzhuimengshaonian wisdom-education
- CVE-2025-11079Campcodes Farm Management System file information disclosureCampcodes Farm Management System
- CVE-2025-11078itsourcecode Open Source Job Portal controller.php unrestricted uploaditsourcecode Open Source Job Portal
- CVE-2025-11077Campcodes Online Learning Management System add_content.php sql injectionCampcodes Online Learning Management System
- CVE-2025-11076Campcodes Online Learning Management System edit_teacher.php sql injectionCampcodes Online Learning Management System
- CVE-2025-11075Campcodes Online Learning Management System de_activate.php sql injectionCampcodes Online Learning Management System
- CVE-2025-11074code-projects Project Monitoring System login.php sql injectioncode-projects Project Monitoring System
- CVE-2025-11073Keyfactor RG-EW5100BE HTTP POST Request cmd command injectionKeyfactor RG-EW5100BE
- CVE-2025-11071SeaCMS Cron Task Management admin_cron.php sql injectionSeaCMS
- CVE-2025-11070Projectworlds Online Shopping System cart_add.php sql injectionProjectworlds Online Shopping System
- CVE-2025-11069westboy CicadasCMS Add Department save cross site scriptingwestboy CicadasCMS
- CVE-2025-11068westboy CicadasCMS save cross site scriptingwestboy CicadasCMS
- CVE-2025-11067Projectworlds Visitor Management System Add Visitor myform.php cross site scriptingProjectworlds Visitor Management System
- CVE-2025-11066code-projects Online Bidding System bidlist.php sql injectioncode-projects Online Bidding System
- CVE-2025-11064Campcodes Online Learning Management System teachers.php sql injectionCampcodes Online Learning Management System
- CVE-2025-11063Campcodes Online Learning Management System edit_department.php sql injectionCampcodes Online Learning Management System
- CVE-2025-11062Campcodes Online Learning Management System save_student.php sql injectionCampcodes Online Learning Management System
- CVE-2025-11061Campcodes Online Learning Management System edit_student.php sql injectionCampcodes Online Learning Management System
- CVE-2025-11057SourceCodester Pet Grooming Management Software print_inv.php sql injectionSourceCodester Pet Grooming Management Software
- CVE-2025-11056ProjectsAndPrograms School Management System select-students.php sql injectionProjectsAndPrograms School Management System
- CVE-2025-11055SourceCodester Online Hotel Reservation System updateaddress.php sql injectionSourceCodester Online Hotel Reservation System
- CVE-2025-11054itsourcecode Open Source Job Portal index.php sql injectionitsourcecode Open Source Job Portal
- CVE-2025-11053PHPGurukul Small CRM forgot-password.php sql injectionPHPGurukul Small CRM
- CVE-2025-11052kidaze CourseSelectionSystem COUNT3s5.php sql injectionkidaze CourseSelectionSystem
- CVE-2025-9893VM Menu Reorder plugin <= 1.0.0 - Cross-Site Request Forgery to Settings Updatemilankyada VM Menu Reorder plugin
- CVE-2025-9944Professional Contact Form <= 1.0.0 - Cross-Site Request Forgery to Test Email Sendingkelderic Professional Contact Form
- CVE-2025-9898cForms – Light speed fast Form Builder <= 3.0.0 - Cross-Site Request Forgerycompojoom cForms – Light speed fast Form Builder
- CVE-2025-9899Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms <= 1.0 - Cross-Site Request Forgerytrustreviews Trust Reviews plugin for Google, Tripadvisor,…
- CVE-2025-9894Sync Feedly <= 1.0.1 - Cross-Site Request Forgery to Sync Triggercristianr909090 Sync Feedly
- CVE-2025-9896HidePost <= 2.3.8 - Cross-Site Request Forgeryfunnnny HidePost
- CVE-2025-11051SourceCodester Pet Grooming Management Software cross-site request forgerySourceCodester Pet Grooming Management Software
- CVE-2025-10954Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Inputgithub.com/nyaruka/phonenumbers
- CVE-2025-11050Portabilis i-Educar periodo-lancamento improper authorizationPortabilis i-Educar
- CVE-2025-11049Portabilis i-Educar unificacao-aluno improper authorizationPortabilis i-Educar
- CVE-2025-10498Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletionkstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2025-10499Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Updatekstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2025-8440Team Members <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scriptingspwebguy Team Members
- CVE-2025-36239IBM Storage TS4500 Library cross-site scriptingIBM Storage TS4500 Library
- CVE-2024-43192IBM Storage TS4500 Library cross-site request forgeryIBM Storage TS4500 Library
- CVE-2025-59938Heap buffer overflow in wazuh-analysisdwazuh
- CVE-2025-36144IBM watsonx.data information disclosureIBM watsonx.data