# CVEs published 2025-09-27

53 CVEs were published on September 27, 2025: 1 critical, 7 high. Days are UTC.

- [CVE-2025-11088](https://cve.now/CVE-2025-11088.md): itsourcecode Open Source Job Portal index.php sql injection (CVSS 5.3, itsourcecode Open Source Job Portal)
- [CVE-2025-11083](https://cve.now/CVE-2025-11083.md): GNU Binutils Linker elfcode.h elf\_swap\_shdr heap-based overflow (CVSS 4.8, GNU Binutils)
- [CVE-2025-11082](https://cve.now/CVE-2025-11082.md): GNU Binutils Linker elf-eh-frame.c \_bfd\_elf\_parse\_eh\_frame heap-based overflow (CVSS 4.8, GNU Binutils)
- [CVE-2025-11081](https://cve.now/CVE-2025-11081.md): GNU Binutils objdump.c dump\_dwarf\_section out-of-bounds (CVSS 4.8, GNU Binutils)
- [CVE-2025-11080](https://cve.now/CVE-2025-11080.md): zhuimengshaonian wisdom-education ExamInfoController.java selectStudentExamInfoList improper authorization (CVSS 5.3, zhuimengshaonian wisdom-education)
- [CVE-2025-11079](https://cve.now/CVE-2025-11079.md): Campcodes Farm Management System file information disclosure (CVSS 6.9, Campcodes Farm Management System)
- [CVE-2025-11078](https://cve.now/CVE-2025-11078.md): itsourcecode Open Source Job Portal controller.php unrestricted upload (CVSS 5.3, itsourcecode Open Source Job Portal)
- [CVE-2025-11077](https://cve.now/CVE-2025-11077.md): Campcodes Online Learning Management System add\_content.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-11076](https://cve.now/CVE-2025-11076.md): Campcodes Online Learning Management System edit\_teacher.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-11075](https://cve.now/CVE-2025-11075.md): Campcodes Online Learning Management System de\_activate.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-11074](https://cve.now/CVE-2025-11074.md): code-projects Project Monitoring System login.php sql injection (CVSS 6.9, code-projects Project Monitoring System)
- [CVE-2025-11073](https://cve.now/CVE-2025-11073.md): Keyfactor RG-EW5100BE HTTP POST Request cmd command injection (CVSS 5.1, Keyfactor RG-EW5100BE)
- [CVE-2025-11071](https://cve.now/CVE-2025-11071.md): SeaCMS Cron Task Management admin\_cron.php sql injection (CVSS 5.1, SeaCMS)
- [CVE-2025-11070](https://cve.now/CVE-2025-11070.md): Projectworlds Online Shopping System cart\_add.php sql injection (CVSS 6.9, Projectworlds Online Shopping System)
- [CVE-2025-7647](https://cve.now/CVE-2025-7647.md): Insecure Temporary File Handling in run-llama/llama\_index (CVSS 7.3, run-llama/llama\_index · llama-index-core)
- [CVE-2025-8014](https://cve.now/CVE-2025-8014.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-11069](https://cve.now/CVE-2025-11069.md): westboy CicadasCMS Add Department save cross site scripting (CVSS 4.8, westboy CicadasCMS)
- [CVE-2025-11068](https://cve.now/CVE-2025-11068.md): westboy CicadasCMS save cross site scripting (CVSS 4.8, westboy CicadasCMS)
- [CVE-2025-11067](https://cve.now/CVE-2025-11067.md): Projectworlds Visitor Management System Add Visitor myform.php cross site scripting (CVSS 4.8, Projectworlds Visitor Management System)
- [CVE-2025-11066](https://cve.now/CVE-2025-11066.md): code-projects Online Bidding System bidlist.php sql injection (CVSS 6.9, code-projects Online Bidding System)
- [CVE-2025-11064](https://cve.now/CVE-2025-11064.md): Campcodes Online Learning Management System teachers.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-11063](https://cve.now/CVE-2025-11063.md): Campcodes Online Learning Management System edit\_department.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-11062](https://cve.now/CVE-2025-11062.md): Campcodes Online Learning Management System save\_student.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-11061](https://cve.now/CVE-2025-11061.md): Campcodes Online Learning Management System edit\_student.php sql injection (CVSS 6.9, Campcodes Online Learning Management System)
- [CVE-2025-11057](https://cve.now/CVE-2025-11057.md): SourceCodester Pet Grooming Management Software print\_inv.php sql injection (CVSS 6.9, SourceCodester Pet Grooming Management Software)
- [CVE-2025-11056](https://cve.now/CVE-2025-11056.md): ProjectsAndPrograms School Management System select-students.php sql injection (CVSS 5.3, ProjectsAndPrograms School Management System)
- [CVE-2025-11055](https://cve.now/CVE-2025-11055.md): SourceCodester Online Hotel Reservation System updateaddress.php sql injection (CVSS 6.9, SourceCodester Online Hotel Reservation System)
- [CVE-2025-11054](https://cve.now/CVE-2025-11054.md): itsourcecode Open Source Job Portal index.php sql injection (CVSS 5.3, itsourcecode Open Source Job Portal)
- [CVE-2025-11053](https://cve.now/CVE-2025-11053.md): PHPGurukul Small CRM forgot-password.php sql injection (CVSS 6.9, PHPGurukul Small CRM)
- [CVE-2025-11052](https://cve.now/CVE-2025-11052.md): kidaze CourseSelectionSystem COUNT3s5.php sql injection (CVSS 6.9, kidaze CourseSelectionSystem)
- [CVE-2025-9893](https://cve.now/CVE-2025-9893.md): VM Menu Reorder plugin \<= 1.0.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, milankyada VM Menu Reorder plugin)
- [CVE-2025-9944](https://cve.now/CVE-2025-9944.md): Professional Contact Form \<= 1.0.0 - Cross-Site Request Forgery to Test Email Sending (CVSS 4.3, kelderic Professional Contact Form)
- [CVE-2025-9898](https://cve.now/CVE-2025-9898.md): cForms – Light speed fast Form Builder \<= 3.0.0 - Cross-Site Request Forgery (CVSS 4.3, compojoom cForms – Light speed fast Form Builder)
- [CVE-2025-9899](https://cve.now/CVE-2025-9899.md): Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms \<= 1.0 - Cross-Site Request Forgery (CVSS 6.1, trustreviews Trust Reviews plugin for Google, Tripadvisor,…)
- [CVE-2025-9894](https://cve.now/CVE-2025-9894.md): Sync Feedly \<= 1.0.1 - Cross-Site Request Forgery to Sync Trigger (CVSS 4.3, cristianr909090 Sync Feedly)
- [CVE-2025-9896](https://cve.now/CVE-2025-9896.md): HidePost \<= 2.3.8 - Cross-Site Request Forgery (CVSS 4.3, funnnny HidePost)
- [CVE-2025-11051](https://cve.now/CVE-2025-11051.md): SourceCodester Pet Grooming Management Software cross-site request forgery (CVSS 5.3, SourceCodester Pet Grooming Management Software)
- [CVE-2025-3193](https://cve.now/CVE-2025-3193.md): Versions of the package algoliasearch-helper from 2.0.0-rc1 and before 3.11.2 are vulnerable to Prototype Pollution in the \_merge() function (CVSS 7.5, algoliasearch-helper)
- [CVE-2025-10954](https://cve.now/CVE-2025-10954.md): Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input (CVSS 6.9, github.com/nyaruka/phonenumbers)
- [CVE-2025-11050](https://cve.now/CVE-2025-11050.md): Portabilis i-Educar periodo-lancamento improper authorization (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-9816](https://cve.now/CVE-2025-9816.md): WP Statistics \<= 14.5.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header (CVSS 7.2, veronalabs WP Statistics – Simple, privacy-friendly Google…)
- [CVE-2025-11049](https://cve.now/CVE-2025-11049.md): Portabilis i-Educar unificacao-aluno improper authorization (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-10498](https://cve.now/CVE-2025-10498.md): Ninja Forms – The Contact Form Builder That Grows With You \<= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion (CVSS 4.3, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2025-10499](https://cve.now/CVE-2025-10499.md): Ninja Forms – The Contact Form Builder That Grows With You \<= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update (CVSS 4.3, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2025-8440](https://cve.now/CVE-2025-8440.md): Team Members \<= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, spwebguy Team Members)
- [CVE-2025-36239](https://cve.now/CVE-2025-36239.md): IBM Storage TS4500 Library cross-site scripting (CVSS 6.1, IBM Storage TS4500 Library)
- [CVE-2024-43192](https://cve.now/CVE-2024-43192.md): IBM Storage TS4500 Library cross-site request forgery (CVSS 6.5, IBM Storage TS4500 Library)
- [CVE-2025-59945](https://cve.now/CVE-2025-59945.md): SysReptor Susceptible to Privilege Escalation by Authenticated Users (CVSS 8.1, Syslifters sysreptor)
- [CVE-2025-59932](https://cve.now/CVE-2025-59932.md): FlagForgeCTF Unauthenticated Resource Modification/Deletion (CVSS 8.6, FlagForgeCTF flagForge)
- [CVE-2025-59939](https://cve.now/CVE-2025-59939.md): WeGIA vulnerable to SQL Injection into method \`excluir\` of the \`ProdutoControle\` class in the parameter \`id\_produto\`. (CVSS 8.8, LabRedesCefetRJ WeGIA)
- [CVE-2025-59938](https://cve.now/CVE-2025-59938.md): Heap buffer overflow in wazuh-analysisd (CVSS 6.5, wazuh)
- [CVE-2025-59936](https://cve.now/CVE-2025-59936.md): get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass (CVSS 9.4, nearform get-jwks · get-jwks)
- [CVE-2025-36144](https://cve.now/CVE-2025-36144.md): IBM watsonx.data information disclosure (CVSS 3.3, IBM watsonx.data)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-09-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.