# CVEs published 2025-09-28 36 CVEs were published on September 28, 2025: 0 critical, 5 high. Days are UTC. - [CVE-2025-11125](https://cve.now/CVE-2025-11125.md): langleyfcu Online Banking System Error Message connection\_error.php cross site scripting (CVSS 5.3, langleyfcu Online Banking System) - [CVE-2025-11124](https://cve.now/CVE-2025-11124.md): code-projects Project Monitoring System postjob.php cross site scripting (CVSS 5.1, code-projects Project Monitoring System) - [CVE-2025-11123](https://cve.now/CVE-2025-11123.md): Tenda AC18 saveAutoQos stack-based overflow (CVSS 8.7, Tenda AC18) - [CVE-2025-11122](https://cve.now/CVE-2025-11122.md): Tenda AC18 WizardHandle stack-based overflow (CVSS 8.7, Tenda AC18) - [CVE-2025-11121](https://cve.now/CVE-2025-11121.md): Tenda AC18 AdvSetLanip command injection (CVSS 5.3, Tenda AC18) - [CVE-2025-11120](https://cve.now/CVE-2025-11120.md): Tenda AC8 SetServerConfig formSetServerConfig buffer overflow (CVSS 8.7, Tenda AC8) - [CVE-2025-11119](https://cve.now/CVE-2025-11119.md): itsourcecode Hostel Management System POST Request index.php cross site scripting (CVSS 5.3, itsourcecode Hostel Management System) - [CVE-2025-11118](https://cve.now/CVE-2025-11118.md): CodeAstro Student Grading System adminLogin.php sql injection (CVSS 6.9, CodeAstro Student Grading System) - [CVE-2025-11117](https://cve.now/CVE-2025-11117.md): Tenda CH22 GstDhcpSetSer formWrlExtraGet buffer overflow (CVSS 8.7, Tenda CH22) - [CVE-2025-11116](https://cve.now/CVE-2025-11116.md): code-projects Simple Scheduling System add.home.php sql injection (CVSS 6.9, code-projects Simple Scheduling System) - [CVE-2025-11115](https://cve.now/CVE-2025-11115.md): code-projects Simple Scheduling System addtime.php sql injection (CVSS 6.9, code-projects Simple Scheduling System) - [CVE-2025-11114](https://cve.now/CVE-2025-11114.md): CodeAstro Online Leave Application leaveAplicationForm.php sql injection (CVSS 5.3, CodeAstro Online Leave Application) - [CVE-2025-11113](https://cve.now/CVE-2025-11113.md): CodeAstro Online Leave Application signup.php sql injection (CVSS 5.3, CodeAstro Online Leave Application) - [CVE-2025-11112](https://cve.now/CVE-2025-11112.md): PHPGurukul Employee Record Management System myprofile.php cross site scripting (CVSS 5.3, PHPGurukul Employee Record Management System) - [CVE-2025-11111](https://cve.now/CVE-2025-11111.md): Campcodes Advanced Online Voting Management System candidates\_edit.php sql injection (CVSS 6.9, Campcodes Advanced Online Voting Management System) - [CVE-2025-11110](https://cve.now/CVE-2025-11110.md): Campcodes Online Learning Management System school\_year.php sql injection (CVSS 6.9, Campcodes Online Learning Management System) - [CVE-2025-11109](https://cve.now/CVE-2025-11109.md): Campcodes Computer Sales and Inventory System us\_edit.php sql injection (CVSS 6.9, Campcodes Computer Sales and Inventory System) - [CVE-2025-11108](https://cve.now/CVE-2025-11108.md): code-projects Simple Scheduling System addroom.php sql injection (CVSS 6.9, code-projects Simple Scheduling System) - [CVE-2025-11107](https://cve.now/CVE-2025-11107.md): code-projects Simple Scheduling System addcourse.php sql injection (CVSS 6.9, code-projects Simple Scheduling System) - [CVE-2025-11106](https://cve.now/CVE-2025-11106.md): code-projects Simple Scheduling System addfaculty.php sql injection (CVSS 6.9, code-projects Simple Scheduling System) - [CVE-2025-11105](https://cve.now/CVE-2025-11105.md): code-projects Simple Scheduling System addsubject.php sql injection (CVSS 6.9, code-projects Simple Scheduling System) - [CVE-2025-11104](https://cve.now/CVE-2025-11104.md): CodeAstro Electricity Billing System bill.php sql injection (CVSS 5.3, CodeAstro Electricity Billing System) - [CVE-2025-11103](https://cve.now/CVE-2025-11103.md): Projectworlds Online Tours and Travels change-image.php unrestricted upload (CVSS 5.1, Projectworlds Online Tours and Travels) - [CVE-2025-11102](https://cve.now/CVE-2025-11102.md): Campcodes Online Learning Management System edit\_content.php sql injection (CVSS 6.9, Campcodes Online Learning Management System) - [CVE-2025-11101](https://cve.now/CVE-2025-11101.md): itsourcecode Open Source Job Portal index.php sql injection (CVSS 6.9, itsourcecode Open Source Job Portal) - [CVE-2025-11100](https://cve.now/CVE-2025-11100.md): D-Link DIR-823X set\_wifi\_blacklists uci\_set command injection (CVSS 5.3, D-Link DIR-823X) - [CVE-2025-11099](https://cve.now/CVE-2025-11099.md): D-Link DIR-823X delete\_prohibiting uci\_del command injection (CVSS 5.3, D-Link DIR-823X) - [CVE-2025-11098](https://cve.now/CVE-2025-11098.md): D-Link DIR-823X set\_wifi\_blacklists command injection (CVSS 5.3, D-Link DIR-823X) - [CVE-2025-11097](https://cve.now/CVE-2025-11097.md): D-Link DIR-823X set\_device\_name command injection (CVSS 5.3, D-Link DIR-823X) - [CVE-2025-11096](https://cve.now/CVE-2025-11096.md): D-Link DIR-823X diag\_traceroute command injection (CVSS 5.3, D-Link DIR-823X) - [CVE-2025-11095](https://cve.now/CVE-2025-11095.md): D-Link DIR-823X delete\_offline\_device command injection (CVSS 5.3, D-Link DIR-823X) - [CVE-2025-11094](https://cve.now/CVE-2025-11094.md): code-projects E-Commerce Website admin\_product\_details.php sql injection (CVSS 6.9, code-projects E-Commerce Website) - [CVE-2025-11092](https://cve.now/CVE-2025-11092.md): D-Link DIR-823X set\_switch\_settings sub\_412E7C command injection (CVSS 5.3, D-Link DIR-823X) - [CVE-2025-11091](https://cve.now/CVE-2025-11091.md): Tenda AC21 SetStaticRouteCfg sscanf buffer overflow (CVSS 8.7, Tenda AC21) - [CVE-2025-11090](https://cve.now/CVE-2025-11090.md): itsourcecode Open Source Job Portal index.php sql injection (CVSS 5.3, itsourcecode Open Source Job Portal) - [CVE-2025-11089](https://cve.now/CVE-2025-11089.md): kidaze CourseSelectionSystem COUNT3s4.php sql injection (CVSS 6.9, kidaze CourseSelectionSystem) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-09-28 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.