# CVEs published 2025-10-03

157 CVEs were published on October 3, 2025: 10 critical, 39 high. Days are UTC.

- [CVE-2025-61685](https://cve.now/CVE-2025-61685.md): Mastra Docs MCP Server \`@mastra/mcp-docs-server\` Leads to Information Exposure (CVSS 6.5, mastra-ai mastra · @mastra/mcp-docs-server)
- [CVE-2025-61681](https://cve.now/CVE-2025-61681.md): Kuno is Vulnerable to Stored XSS Attack via SVG File Upload (CVSS 5.4, xuemian168 kuno)
- [CVE-2025-61680](https://cve.now/CVE-2025-61680.md): Minecraft RCON Terminal: Plain Text Password Storage in Configuration (CVSS 6.6, jaketcooper Minecraft-rcon)
- [CVE-2025-61679](https://cve.now/CVE-2025-61679.md): Anyquery Unauthenticated Access Vulnerability Exposes Private Integration Data (CVSS 7.7, julien040 anyquery)
- [CVE-2025-61677](https://cve.now/CVE-2025-61677.md): DataChain: Deserialization of Untrusted Data from Environment Variables (CVSS 2.5, iterative datachain · datachain)
- [CVE-2025-43825](https://cve.now/CVE-2025-43825.md): A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.5, 2024.Q3 (CVSS 4.6, Liferay Portal · Liferay DXP +1)
- [CVE-2025-61673](https://cve.now/CVE-2025-61673.md): Karapace is vulnerable to Authentication Bypass (CVSS 8.6, Aiven-Open karapace)
- [CVE-2025-10695](https://cve.now/CVE-2025-10695.md): OpenSupports 4.11.0 — SSRF via test imap and smtp endpoints (CVSS 6.9, OpenSupports)
- [CVE-2025-10696](https://cve.now/CVE-2025-10696.md): OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list (CVSS 7.1, OpenSupports)
- [CVE-2025-10692](https://cve.now/CVE-2025-10692.md): OpenSupports 4.11.0 — SQL Injection (CVSS 7.1, OpenSupports)
- [CVE-2025-59944](https://cve.now/CVE-2025-59944.md): Cursor IDE: Sensitive File Overwrite Bypass is Possible (CVSS 8.1, cursor)
- [CVE-2025-59943](https://cve.now/CVE-2025-59943.md): phpMyFAQ duplicate email registration allows multiple accounts with the same email (CVSS 8.1, thorsten phpMyFAQ · thorsten/phpmyfaq)
- [CVE-2025-59829](https://cve.now/CVE-2025-59829.md): Claude Code: Permission deny bypass is possible through symlink (CVSS 2.3, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-54374](https://cve.now/CVE-2025-54374.md): Eidos: One-click Remote Code Execution through Custom URL Handling (CVSS 8.8, mayneyao eidos)
- [CVE-2025-53354](https://cve.now/CVE-2025-53354.md): NiceGUI is vulnerable to Reflected XSS attack (CVSS 6.1, zauberzeug nicegui · nicegui)
- [CVE-2025-49844](https://cve.now/CVE-2025-49844.md): Redis Lua Use-After-Free may lead to remote code execution (CVSS 10.0, redis)
- [CVE-2025-46819](https://cve.now/CVE-2025-46819.md): Redis is vulnerable to DoS via specially crafted LUA scripts (CVSS 6.3, redis)
- [CVE-2025-46818](https://cve.now/CVE-2025-46818.md): Redis: Authenticated users can execute LUA scripts as a different user (CVSS 6.0, redis)
- [CVE-2025-52656](https://cve.now/CVE-2025-52656.md): HCL MyXalytics product is affected by Mass Assignment vulnerability (CVSS 7.6, HCL MyXalytics)
- [CVE-2025-52658](https://cve.now/CVE-2025-52658.md): HCL MyXalytics is affected by the use of vulnerable/outdated versions (CVSS 3.5, HCL Software MyXalytics)
- [CVE-2025-57714](https://cve.now/CVE-2025-57714.md): NetBak Replicator (CVSS 8.5, QNAP Systems NetBak Replicator)
- [CVE-2025-54154](https://cve.now/CVE-2025-54154.md): QNAP Authenticator (CVSS 6.9, QNAP Systems QNAP Authenticator)
- [CVE-2025-54153](https://cve.now/CVE-2025-54153.md): Qsync Central (CVSS 8.6, QNAP Systems Qsync Central)
- [CVE-2025-53595](https://cve.now/CVE-2025-53595.md): Qsync Central (CVSS 8.6, QNAP Systems Qsync Central)
- [CVE-2025-53407](https://cve.now/CVE-2025-53407.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-53406](https://cve.now/CVE-2025-53406.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52867](https://cve.now/CVE-2025-52867.md): Qsync Central (CVSS 6.0, QNAP Systems Qsync Central)
- [CVE-2025-52866](https://cve.now/CVE-2025-52866.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52862](https://cve.now/CVE-2025-52862.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52860](https://cve.now/CVE-2025-52860.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52859](https://cve.now/CVE-2025-52859.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52858](https://cve.now/CVE-2025-52858.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52857](https://cve.now/CVE-2025-52857.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52855](https://cve.now/CVE-2025-52855.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52854](https://cve.now/CVE-2025-52854.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52853](https://cve.now/CVE-2025-52853.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52433](https://cve.now/CVE-2025-52433.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52432](https://cve.now/CVE-2025-52432.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52429](https://cve.now/CVE-2025-52429.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52654](https://cve.now/CVE-2025-52654.md): HCL MyXalytics is affected by an HTML Injection (CVSS 4.6, HCL Software HCL MyXalytics)
- [CVE-2025-52428](https://cve.now/CVE-2025-52428.md): QTS (CVSS 5.1, QNAP Systems QTS)
- [CVE-2025-52427](https://cve.now/CVE-2025-52427.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-52424](https://cve.now/CVE-2025-52424.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-48730](https://cve.now/CVE-2025-48730.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-48729](https://cve.now/CVE-2025-48729.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-48728](https://cve.now/CVE-2025-48728.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-48727](https://cve.now/CVE-2025-48727.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-48726](https://cve.now/CVE-2025-48726.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-47214](https://cve.now/CVE-2025-47214.md): QTS (CVSS 5.1, QNAP Systems QTS)
- [CVE-2025-47213](https://cve.now/CVE-2025-47213.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-47212](https://cve.now/CVE-2025-47212.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-47211](https://cve.now/CVE-2025-47211.md): QTS, QuTS hero (CVSS 6.9, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-47210](https://cve.now/CVE-2025-47210.md): Qsync Central (CVSS 5.3, QNAP Systems Qsync Central)
- [CVE-2025-44014](https://cve.now/CVE-2025-44014.md): Qsync Central (CVSS 7.1, QNAP Systems Qsync Central)
- [CVE-2025-44012](https://cve.now/CVE-2025-44012.md): Qsync Central (CVSS 7.1, QNAP Systems Qsync Central)
- [CVE-2025-44011](https://cve.now/CVE-2025-44011.md): Qsync Central (CVSS 5.3, QNAP Systems Qsync Central)
- [CVE-2025-44010](https://cve.now/CVE-2025-44010.md): Qsync Central (CVSS 5.3, QNAP Systems Qsync Central)
- [CVE-2025-44009](https://cve.now/CVE-2025-44009.md): Qsync Central (CVSS 5.3, QNAP Systems Qsync Central)
- [CVE-2025-44008](https://cve.now/CVE-2025-44008.md): Qsync Central (CVSS 5.3, QNAP Systems Qsync Central)
- [CVE-2025-44007](https://cve.now/CVE-2025-44007.md): Qsync Central (CVSS 7.1, QNAP Systems Qsync Central)
- [CVE-2025-44006](https://cve.now/CVE-2025-44006.md): Qsync Central (CVSS 7.1, QNAP Systems Qsync Central)
- [CVE-2025-33040](https://cve.now/CVE-2025-33040.md): Qsync Central (CVSS 7.1, QNAP Systems Qsync Central)
- [CVE-2025-33039](https://cve.now/CVE-2025-33039.md): Qsync Central (CVSS 7.1, QNAP Systems Qsync Central)
- [CVE-2025-33034](https://cve.now/CVE-2025-33034.md): Qsync Central (CVSS 5.3, QNAP Systems Qsync Central)
- [CVE-2024-56804](https://cve.now/CVE-2024-56804.md): Video Station (CVSS 5.3, QNAP Systems Video Station)
- [CVE-2025-52653](https://cve.now/CVE-2025-52653.md): Cross Site Scripting vulnerability in the web application (CVSS 7.6, HCL MyXalytics)
- [CVE-2025-46817](https://cve.now/CVE-2025-46817.md): Lua library commands may lead to integer overflow and potential RCE (CVSS 7.0, redis)
- [CVE-2025-61593](https://cve.now/CVE-2025-61593.md): Cursor CLI Agent: Sensitive File Overwrite Bypass (CVSS 7.1, cursor)
- [CVE-2025-61592](https://cve.now/CVE-2025-61592.md): Cursor CLI: Arbitrary Code Execution Possible through Permissive CLI Config (CVSS 8.8, cursor)
- [CVE-2025-61591](https://cve.now/CVE-2025-61591.md): Cursor CLI's Cursor Agent MCP OAuth2 Communication is Vulnerable to Remote Code Execution (CVSS 8.8, cursor)
- [CVE-2025-61590](https://cve.now/CVE-2025-61590.md): Cursor is vulnerable to RCE via .code-workspace files using Prompt Injection (CVSS 7.5, cursor)
- [CVE-2025-34226](https://cve.now/CVE-2025-34226.md): OpenPLC Runtime v3 Persistent DoS (CVSS 7.1, Autonomy Logic OpenPLC Runtime)
- [CVE-2025-10729](https://cve.now/CVE-2025-10729.md): Use-after-free vulnerability in Qt SVG qsvghandler.cpp allows denial of service via crafted SVG (CVSS 9.4, Qt)
- [CVE-2025-10728](https://cve.now/CVE-2025-10728.md): Uncontrolled recursion in Qt SVG module (CVSS 9.4, Qt)
- [CVE-2025-10609](https://cve.now/CVE-2025-10609.md): Hardcoded Credentials in Logo Software's TigerWings ERP (CVSS 5.9, Logo Software TigerWings ERP)
- [CVE-2025-10547](https://cve.now/CVE-2025-10547.md): CVE-2025-10547 (CVSS 9.8, DrayTek Vigor1000B · DrayTek Vigor2962 +15)
- [CVE-2025-49641](https://cve.now/CVE-2025-49641.md): Insufficient permission check for the problem.view.refresh action (CVSS 5.1, Zabbix)
- [CVE-2025-27237](https://cve.now/CVE-2025-27237.md): DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration (CVSS 7.3, Zabbix)
- [CVE-2025-27236](https://cve.now/CVE-2025-27236.md): User information disclosure via api\_jsonrpc.php on method user.get with param search (CVSS 2.1, Zabbix)
- [CVE-2025-0876](https://cve.now/CVE-2025-0876.md): XSS in Isin Basi Advertisement & IT's Workif (CVSS 4.1, Isin Basi Advertisement Information Technologies Trade IT's…)
- [CVE-2025-27231](https://cve.now/CVE-2025-27231.md): LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin (CVSS 4.3, Zabbix)
- [CVE-2025-40636](https://cve.now/CVE-2025-40636.md): SQL injection in the mod\_vvisit\_counter module (CVSS 9.3, mod\_vvisit\_counter)
- [CVE-2025-10302](https://cve.now/CVE-2025-10302.md): Ultimate Viral Quiz \<= 1.0 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, hameha Ultimate Viral Quiz)
- [CVE-2025-10165](https://cve.now/CVE-2025-10165.md): AP Background \<= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, hovanesvn AP Background)
- [CVE-2025-9897](https://cve.now/CVE-2025-9897.md): AP Background \<= 3.8.2 - Cross-Site Request Forgery (CVSS 4.3, hovanesvn AP Background)
- [CVE-2025-9212](https://cve.now/CVE-2025-9212.md): WP Dispatcher \<= 1.2.0 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5, ekndev WP Dispatcher)
- [CVE-2025-9561](https://cve.now/CVE-2025-9561.md): AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallaxBackAdminSaveSlider Function (CVSS 8.8, hovanesvn AP Background)
- [CVE-2025-9194](https://cve.now/CVE-2025-9194.md): Constructor \<= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Clean (CVSS 4.3, antonshevchuk Constructor)
- [CVE-2025-9204](https://cve.now/CVE-2025-9204.md): X Addons for Elementor \<= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Field (CVSS 6.4, pencilwp X Addons for Elementor)
- [CVE-2025-9129](https://cve.now/CVE-2025-9129.md): Flexi \<= 4.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via flexi-form-tag Shortcode (CVSS 6.4, odude Flexi – Guest Submit)
- [CVE-2025-7825](https://cve.now/CVE-2025-7825.md): Schema Plugin For Divi, Gutenberg & Shortcodes \<= 4.3.2 - Authenticated (Contributor+) Object Instantiation (CVSS 6.3, wpt00ls Schema Plugin For Divi, Gutenberg & Shortcodes)
- [CVE-2025-9895](https://cve.now/CVE-2025-9895.md): Notification Bar \<= 2.2 - Cross-Site Request Forgery (CVSS 4.3, umarbajwa Notification Bar)
- [CVE-2025-9858](https://cve.now/CVE-2025-9858.md): Auto Bulb Finder for WordPress \<= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mtoolstec Auto Bulb Finder for WordPress)
- [CVE-2025-9630](https://cve.now/CVE-2025-9630.md): WP SinoType \<= 1.0 - Cross-Site Request Forgery (CVSS 4.3, samueljesse WP SinoType)
- [CVE-2025-10582](https://cve.now/CVE-2025-10582.md): WP Dispatcher \<= 1.2.0 - Authenticated (Contributor+) SQL Injection (CVSS 8.8, ekndev WP Dispatcher)
- [CVE-2025-9889](https://cve.now/CVE-2025-9889.md): ContentMX Content Publisher \<= 1.0.6 - Cross-Site Request Forgery (CVSS 4.3, ContentMX Content Publisher)
- [CVE-2025-8669](https://cve.now/CVE-2025-8669.md): Customify \<= 0.4.11 - Cross-Site Request Forgery (CVSS 4.3, pressmaximum Customify)
- [CVE-2025-9859](https://cve.now/CVE-2025-9859.md): Fintelligence Calculator \<= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ambitioncloud Fintelligence Calculator)
- [CVE-2025-8776](https://cve.now/CVE-2025-8776.md): Epic Bootstrap Buttons \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icol Parameter (CVSS 6.4, mikemayhem3030 Epic Bootstrap Buttons)
- [CVE-2025-9372](https://cve.now/CVE-2025-9372.md): Ultimate Multi Design Video Carousel \<= 1.4 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 5.5, gbsdeveloper Ultimate Multi Design Video Carousel)
- [CVE-2025-9200](https://cve.now/CVE-2025-9200.md): Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App \<= 0.8.8.8 - Unauthenticated SQL Injection (CVSS 7.5, nebelhorn Blappsta Mobile App Plugin – Your native, mobile…)
- [CVE-2025-9892](https://cve.now/CVE-2025-9892.md): Restrict User Registration \<= 1.0.1 - Cross-Site Request Forgery to Settings Update (CVSS 5.3, devrix Restrict User Registration)
- [CVE-2025-9199](https://cve.now/CVE-2025-9199.md): Woo superb slideshow transition gallery with random effect \<= 9.1 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, gopiplus Woo superb slideshow transition gallery with rando…)
- [CVE-2025-10309](https://cve.now/CVE-2025-10309.md): PayPal Forms \<= 1.0.3 - Cross-Site Request Forgery (CVSS 4.3, bsmye PayPal Forms)
- [CVE-2025-10053](https://cve.now/CVE-2025-10053.md): TableGen – Data Table Generator \<= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, exlac TableGen – Data Table Generator)
- [CVE-2025-9206](https://cve.now/CVE-2025-9206.md): Meks Easy Maps \<= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mekshq Meks Easy Maps)
- [CVE-2025-9080](https://cve.now/CVE-2025-9080.md): Generic Elements \<= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, bdevs Generic Elements)
- [CVE-2025-9854](https://cve.now/CVE-2025-9854.md): A Simple Multilanguage Plugin \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, piupiiu A Simple Multilanguage Plugin)
- [CVE-2025-9945](https://cve.now/CVE-2025-9945.md): Optimize More! – CSS \<= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset (CVSS 4.3, aryadhiratara Optimize More! – CSS)
- [CVE-2025-10306](https://cve.now/CVE-2025-10306.md): Backup Bolt \<= 1.4.1 - Authenticated (Admin+) Arbitrary File Download (CVSS 3.8, backupbolt Backup Bolt)
- [CVE-2025-10192](https://cve.now/CVE-2025-10192.md): WP Photo Effects \<= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, muhammad-rehman WP Photo Effects)
- [CVE-2025-9884](https://cve.now/CVE-2025-9884.md): Mobile Site Redirect \<= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, webdevabq Mobile Site Redirect)
- [CVE-2025-9077](https://cve.now/CVE-2025-9077.md): Ultra Addons Lite for Elementor \<= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field (CVSS 6.4, ultrapressorg Ultra Addons Lite for Elementor)
- [CVE-2025-7721](https://cve.now/CVE-2025-7721.md): JoomSport \<= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion (CVSS 9.8, beardev JoomSport – for Sports: Team & League, Football, Ho…)
- [CVE-2025-9332](https://cve.now/CVE-2025-9332.md): Interactive Medical Drawing of Human Body \<= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 5.5, clickanatomy Interactive Human Anatomy with Clickable Body…)
- [CVE-2025-9876](https://cve.now/CVE-2025-9876.md): Ird Slider \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, inforrada Ird Slider)
- [CVE-2025-9875](https://cve.now/CVE-2025-9875.md): Event Tickets, RSVPs, Calendar \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ticketspot Event Tickets, RSVPs, Calendar)
- [CVE-2025-9198](https://cve.now/CVE-2025-9198.md): Wp cycle text announcement \<= 8.1 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, gopi\_plus Wp cycle text announcement)
- [CVE-2025-9286](https://cve.now/CVE-2025-9286.md): Appy Pie Connect for WooCommerce \<= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset\_user\_password (CVSS 9.8, hancock11 Appy Pie Connect for WooCommerce)
- [CVE-2025-9209](https://cve.now/CVE-2025-9209.md): RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT (CVSS 9.8, magnigenie RestroPress – Online Food Ordering System)
- [CVE-2025-9885](https://cve.now/CVE-2025-9885.md): MPWizard – Create Mercado Pago Payment Links \<= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion (CVSS 4.3, laudanumsoft MPWizard – Create Mercado Pago Payment Links)
- [CVE-2025-9333](https://cve.now/CVE-2025-9333.md): Smart Docs \<= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 5.5, ibachal Smart Docs)
- [CVE-2025-9130](https://cve.now/CVE-2025-9130.md): Unify \<= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify\_checkout Shortcode (CVSS 6.4, codeclouds Unify)
- [CVE-2025-10726](https://cve.now/CVE-2025-10726.md): WPRecovery \<= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion (CVSS 9.1, quantumrose WPRecovery)
- [CVE-2025-10311](https://cve.now/CVE-2025-10311.md): Comment Info Detector \<= 1.0.5 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, tom\_riddle Comment Info Detector)
- [CVE-2025-9045](https://cve.now/CVE-2025-9045.md): Easy Elementor Addons \<= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, hashthemes Easy Elementor Addons – Addons Pack for Elemento…)
- [CVE-2025-10212](https://cve.now/CVE-2025-10212.md): SiteAlert (Formerly WP Health) \<= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure (CVSS 5.3, SiteAlert)
- [CVE-2025-9213](https://cve.now/CVE-2025-9213.md): TextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account Takeover (CVSS 8.8, TextBuilder)
- [CVE-2025-11234](https://cve.now/CVE-2025-11234.md): Qemu-kvm: vnc websocket handshake use-after-free (CVSS 7.5, qemu · Red Hat Enterprise Linux +1)
- [CVE-2025-6388](https://cve.now/CVE-2025-6388.md): Spirit Framework \<= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation (CVSS 9.8, Theme-Spirit Spirit Framework)
- [CVE-2025-0616](https://cve.now/CVE-2025-0616.md): SQLi in Teknolojik Center Telecommunication's B2B - Netsis Panel (CVSS 8.2, Teknolojik Center Telecommunication Industry Trade Co. B2B…)
- [CVE-2025-11223](https://cve.now/CVE-2025-11223.md): Installer of Panasonic AutoDownloader version 1.2.8 contains an issue with the DLL search path, which may lead to loading a craft (CVSS 8.4, Panasonic AutoDownloader)
- [CVE-2025-61589](https://cve.now/CVE-2025-61589.md): Cursor: Potential Information Leakage via Mermaid Diagram (CVSS 5.9, cursor)
- [CVE-2025-59536](https://cve.now/CVE-2025-59536.md): Claude Code's startup trust dialog could lead to Command Execution attack (CVSS 8.7, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-61599](https://cve.now/CVE-2025-61599.md): Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Input (CVSS 5.1, emlog)
- [CVE-2025-61597](https://cve.now/CVE-2025-61597.md): Emlog Pro is vulnerable to stored XSS attack through HTML template injection (CVSS 7.6, emlog)
- [CVE-2025-59300](https://cve.now/CVE-2025-59300.md): File Parsing Out-Of-Bounds Write Vulnerability in DIAScreen (CVSS 6.8, Delta Electronics DIAScreen)
- [CVE-2025-59299](https://cve.now/CVE-2025-59299.md): File Parsing Out-Of-Bounds Write Vulnerability in DIAScreen (CVSS 6.8, Delta Electronics DIAScreen)
- [CVE-2025-59298](https://cve.now/CVE-2025-59298.md): File Parsing Out-Of-Bounds Write Vulnerability in DIAScreen (CVSS 6.8, Delta Electronics DIAScreen)
- [CVE-2025-59297](https://cve.now/CVE-2025-59297.md): File Parsing Out-Of-Bounds Write Vulnerability in DIAScreen (CVSS 6.8, Delta Electronics DIAScreen)
- [CVE-2025-11241](https://cve.now/CVE-2025-11241.md): Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Yoast SEO Premium)
- [CVE-2021-42193](https://cve.now/CVE-2021-42193.md): nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/\[id\]. (CVSS 6.1)
- [CVE-2025-55971](https://cve.now/CVE-2025-55971.md): TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthentic (CVSS 4.7)
- [CVE-2025-55972](https://cve.now/CVE-2025-55972.md): A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Denial of Service (DoS) (CVSS 7.5)
- [CVE-2025-56551](https://cve.now/CVE-2025-56551.md): An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate login interface with a (CVSS 8.2)
- [CVE-2025-57423](https://cve.now/CVE-2025-57423.md): A SQL injection vulnerability was discovered in the /articles endpoint of MyClub 0.5, affecting the query parameters Content, GroupName, Per (CVSS 6.5)
- [CVE-2025-59489](https://cve.now/CVE-2025-59489.md): Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code f (CVSS 7.4, Unity3D Unity Editor)
- [CVE-2025-60445](https://cve.now/CVE-2025-60445.md): A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. (CVSS 6.1)
- [CVE-2025-60447](https://cve.now/CVE-2025-60447.md): A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. (CVSS 5.9)
- [CVE-2025-60448](https://cve.now/CVE-2025-60448.md): A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. (CVSS 6.1)
- [CVE-2025-60449](https://cve.now/CVE-2025-60449.md): An information disclosure vulnerability has been discovered in SeaCMS 13.1. (CVSS 4.9)
- [CVE-2025-60450](https://cve.now/CVE-2025-60450.md): A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. (CVSS 6.1)
- [CVE-2025-60451](https://cve.now/CVE-2025-60451.md): A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. (CVSS 6.1)
- [CVE-2025-60452](https://cve.now/CVE-2025-60452.md): A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. (CVSS 6.1)
- [CVE-2025-60453](https://cve.now/CVE-2025-60453.md): A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. (CVSS 6.1)
- [CVE-2025-60454](https://cve.now/CVE-2025-60454.md): A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. (CVSS 6.1)
- [CVE-2025-60787](https://cve.now/CVE-2025-60787.md): MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image\_file\_name. (CVSS 7.2, motioneye)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.