# CVEs published 2025-10-05

39 CVEs were published on October 5, 2025: 1 critical, 10 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-11310](https://cve.now/CVE-2025-11310.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findFileServerPage.do findFileServerPage sql injection (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-11309](https://cve.now/CVE-2025-11309.md): Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护系统 findDeptPage.do doFilter sql injection (CVSS 6.9, Tipray 厦门天锐科技股份有限公司 Data Leakage Prevention System 天锐数据泄露防护…)
- [CVE-2025-11308](https://cve.now/CVE-2025-11308.md): Vanderlande Baggage 360 messages cross site scripting (CVSS 5.1, Vanderlande Baggage)
- [CVE-2025-11306](https://cve.now/CVE-2025-11306.md): qianfox FoxCMS Search cross site scripting (CVSS 5.3, qianfox FoxCMS)
- [CVE-2025-11305](https://cve.now/CVE-2025-11305.md): UTT HiPER 840G formTaskEdit strcpy buffer overflow (CVSS 8.7, UTT HiPER)
- [CVE-2025-11304](https://cve.now/CVE-2025-11304.md): CodeCanyon/ui-lib Mentor LMS API cross-domain policy (CVSS 5.3, CodeCanyon Mentor LMS · ui-lib Mentor LMS)
- [CVE-2025-11303](https://cve.now/CVE-2025-11303.md): Belkin F9K1015 mp command injection (CVSS 5.3, Belkin F9K1015)
- [CVE-2025-11302](https://cve.now/CVE-2025-11302.md): Belkin F9K1015 formWpsStart buffer overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2025-11301](https://cve.now/CVE-2025-11301.md): Belkin F9K1015 formWlanSetupWPS buffer overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2025-11300](https://cve.now/CVE-2025-11300.md): Belkin F9K1015 formWlanMP buffer overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2025-11299](https://cve.now/CVE-2025-11299.md): Belkin F9K1015 formWanTcpipSetup buffer overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2025-11298](https://cve.now/CVE-2025-11298.md): Belkin F9K1015 formSetWanStatic command injection (CVSS 5.3, Belkin F9K1015)
- [CVE-2025-11297](https://cve.now/CVE-2025-11297.md): Belkin F9K1015 formSetLanguage buffer overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2025-11296](https://cve.now/CVE-2025-11296.md): Belkin F9K1015 formPPTPSetup buffer overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2025-11295](https://cve.now/CVE-2025-11295.md): Belkin F9K1015 formPPPoESetup buffer overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2025-11294](https://cve.now/CVE-2025-11294.md): Belkin F9K1015 formL2TPSetup buffer overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2025-11293](https://cve.now/CVE-2025-11293.md): Belkin F9K1015 formConnectionSetting buffer overflow (CVSS 8.7, Belkin F9K1015)
- [CVE-2025-11292](https://cve.now/CVE-2025-11292.md): Belkin F9K1015 formBSSetSitesurvey command injection (CVSS 5.3, Belkin F9K1015)
- [CVE-2025-11291](https://cve.now/CVE-2025-11291.md): ixmaps website2017 HTTP GET Request map.php cross site scripting (CVSS 5.3, ixmaps website2017)
- [CVE-2025-11290](https://cve.now/CVE-2025-11290.md): CRMEB JWT HMAC Secret hard-coded key (CVSS 6.3, CRMEB)
- [CVE-2025-11289](https://cve.now/CVE-2025-11289.md): westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting (CVSS 4.8, westboy CicadasCMS)
- [CVE-2025-8917](https://cve.now/CVE-2025-8917.md): Path Traversal Leading to Remote Code Execution in allegroai/clearml (CVSS 5.8, allegroai/clearml · clearml)
- [CVE-2025-8406](https://cve.now/CVE-2025-8406.md): Path Traversal in zenml-io/zenml (CVSS 6.3, zenml-io/zenml · zenml)
- [CVE-2025-11288](https://cve.now/CVE-2025-11288.md): CRMEB GET Parameter product sql injection (CVSS 5.3, CRMEB)
- [CVE-2025-11287](https://cve.now/CVE-2025-11287.md): samanhappy MCPHub sseService.ts handleSseConnectionfunction improper authentication (CVSS 6.9, samanhappy MCPHub · @samanhappy/mcphub)
- [CVE-2025-11286](https://cve.now/CVE-2025-11286.md): samanhappy MCPHub MCPRouter Service serverController.ts server-side request forgery (CVSS 5.1, samanhappy MCPHub)
- [CVE-2025-11285](https://cve.now/CVE-2025-11285.md): samanhappy MCPHub serverController.ts os command injection (CVSS 5.3, samanhappy MCPHub · @samanhappy/mcphub)
- [CVE-2025-11284](https://cve.now/CVE-2025-11284.md): Zytec Dalian Zhuoyun Technology Central Authentication Service HTTP Header git hard-coded password (CVSS 6.9, Zytec Dalian Zhuoyun Technology Central Authentication Serv…)
- [CVE-2025-11283](https://cve.now/CVE-2025-11283.md): Frappe LMS Course cross site scripting (CVSS 4.8, Frappe LMS)
- [CVE-2025-11282](https://cve.now/CVE-2025-11282.md): Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting (CVSS 4.8, Frappe LMS)
- [CVE-2025-11281](https://cve.now/CVE-2025-11281.md): Frappe LMS Unpublished Course courses access control (CVSS 2.3, Frappe LMS)
- [CVE-2025-11280](https://cve.now/CVE-2025-11280.md): Frappe LMS Assignment Picture files direct request (CVSS 6.3, Frappe LMS)
- [CVE-2025-61882](https://cve.now/CVE-2025-61882.md): Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). (CVSS 9.8, KEV, Oracle Concurrent Processing)
- [CVE-2025-11279](https://cve.now/CVE-2025-11279.md): Axosoft Scrum and Bug Tracking Add Work Item csv injection (CVSS 5.1, Axosoft Scrum and Bug Tracking)
- [CVE-2025-11278](https://cve.now/CVE-2025-11278.md): AllStarLink Supermon AllMon2 cross site scripting (CVSS 5.3, AllStarLink Supermon)
- [CVE-2025-11277](https://cve.now/CVE-2025-11277.md): Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-11276](https://cve.now/CVE-2025-11276.md): Rebuild Comment/Guestbook cross site scripting (CVSS 5.1, Rebuild)
- [CVE-2025-11275](https://cve.now/CVE-2025-11275.md): Open Asset Import Library Assimp OpenDDLParserUtils.h getNextSeparator heap-based overflow (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-11274](https://cve.now/CVE-2025-11274.md): Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile allocation of resources (CVSS 4.8, Open Asset Import Library Assimp · pyassimp)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.