CVEs published October 8, 2025
102 CVEs were published on October 8, 2025: 9 critical, 12 high.
- Published
- 102
- Critical
- 9
- High
- 12
- Medium
- 76
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 33
Most affected products
- JhumanJ OpnForm
- 9
- SourceCodester Hotel and Lodge Management System
- 6
- code-projects E-Commerce Website
- 4
- Liferay Portal · Liferay DXP +1
- 4
- PHPGurukul Beauty Parlour Management System
- 4
- code-projects Voting System
- 3
- denoland deno · deno
- 3
- projectworlds Advanced Library Management System
- 3
- SourceCodester Farm Management System
- 3
- SourceCodester Simple E-Commerce Bookstore
- 3
Critical 9
- CVE-2025-61913Flowise is vulnerable to arbitrary file read, arbitrary file writeFlowiseAI Flowise · flowise +1
- CVE-2017-20202Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain CompromiseWeb Developer for Chrome
- CVE-2017-20201CCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain CompromisePiriform CCleaner
- CVE-2025-10353Missing Authorization vulnerability in Melis PlatformMelis Technology Melis Platform · melisplatform/melis-cms-s…
- CVE-2025-10352Missing Authorization vulnerability in Melis PlatformMelis Technology Melis Platform · melisplatform/melis-core
- CVE-2025-10351SQL injection vulnerability in Melis PlatformMelis Technology Melis Platform · melisplatform/melis-cms
- CVE-2025-10587Community Events <= 1.5.1 - Unauthenticated SQL Injectionjackdewey Community Events
- CVE-2025-11423Tenda CH22 SafeEmailFilter formSafeEmailFilter memory corruptionTenda CH22
- CVE-2025-11418Tenda CH22 HTTP Request AdvSetWrlsafeset formWrlsafeset stack-based overflowTenda CH22
High 12
- CVE-2025-11535MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directoriesMongoDB Connector for BI
- CVE-2025-9868Nexus Repository 2 - SSRF Vulnerability in Remote Browser PluginSonatype Nexus Repository
- CVE-2025-11444TOTOLINK N600R HTTP Request cstecgi.cgi setWiFiBasicConfig buffer overflowTOTOLINK N600R
- CVE-2025-10635Find Me On <= 2.0.9.1 - Subscriber+ SQL InjectionFind Me On
- CVE-2025-11204RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injectionmetagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2025-10494Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletionstylemix Motors – Car Dealership & Classified Listings Plug…
- CVE-2025-61787Deno is Vulnerable to Command Injection on Windows During Batch File Executiondenoland deno · deno
- CVE-2025-48981An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and maniCompuGroup Medical CGM MEDICO
- CVE-2025-53967Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a craftFramelink Figma MCP Server · figma-developer-mcp
- CVE-2025-57457An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Command
- CVE-2025-60311ProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in the profile/edit.php page
- CVE-2025-61524An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.github.com/casdoor/casdoor
Medium, low and unrated 81
- CVE-2025-11513code-projects E-Commerce Website supplier_update.php sql injectioncode-projects E-Commerce Website
- CVE-2025-11512code-projects Voting System voters_add.php cross site scriptingcode-projects Voting System
- CVE-2025-11511code-projects E-Commerce Website supplier_add.php sql injectioncode-projects E-Commerce Website
- CVE-2025-11509code-projects E-Commerce Website product_add.php sql injectioncode-projects E-Commerce Website
- CVE-2025-11508code-projects Voting System voters_add.php unrestricted uploadcode-projects Voting System
- CVE-2025-11507PHPGurukul Beauty Parlour Management System search-invoices.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-11506PHPGurukul Beauty Parlour Management System search-appointment.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-11505PHPGurukul Beauty Parlour Management System new-appointment.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-11503PHPGurukul Beauty Parlour Management System manage-services.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-11495GNU Binutils Linker elf64-x86-64.c elf_x86_64_relocate_section heap-based overflowGNU Binutils
- CVE-2025-11494GNU Binutils Linker elfxx-x86.c _bfd_x86_elf_late_size_sections out-of-boundsGNU Binutils
- CVE-2025-11491wonderwhy-er DesktopCommanderMCP command-manager.ts CommandManager os command injectionwonderwhy-er DesktopCommanderMCP
- CVE-2025-11490wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injectionwonderwhy-er DesktopCommanderMCP
- CVE-2025-61906Opencast's editor accidentally publishes videos/overwrites publications #1626opencast
- CVE-2025-61788Opencast Paella Player 7 vulnerable to Cross-Site-Scriptingopencast · org.opencastproject:opencast-common
- CVE-2025-11489wonderwhy-er DesktopCommanderMCP filesystem.ts isPathAllowed symlinkwonderwhy-er DesktopCommanderMCP
- CVE-2025-11488D-Link DIR-852 HNAP1 command injectionD-Link DIR-852
- CVE-2025-11487SourceCodester Farm Management System uploadProduct.php sql injectionSourceCodester Farm Management System
- CVE-2025-42701CrowdStrike Falcon Sensor for Windows Race ConditionCrowdStrike Falcon sensor for Windows
- CVE-2025-42706CrowdStrike Falcon Sensor for Windows Logic ErrorCrowdStrike Falcon sensor for Windows
- CVE-2025-11486SourceCodester Farm Management System buyNow.php sql injectionSourceCodester Farm Management System
- CVE-2025-11485SourceCodester Student Grades Management System Manage Users admin.php add_user cross site scriptingSourceCodester Student Grades Management System
- CVE-2025-9970Application credential stored in clear text in memoryABB MConfig
- CVE-2025-11481varunsardana004 Blood-Bank-And-Donation-Management-System donate_blood.php sql injectionvarunsardana004 Blood-Bank-And-Donation-Management-System
- CVE-2025-5009Information Disclosure in Gemini iOS AppGoogle Gemini
- CVE-2025-36636Improper Access ControlTenable Security Center
- CVE-2025-61672Synapse: Invalid device keys degrade federation functionalityelement-hq synapse · matrix-synapse
- CVE-2025-43724Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability.Dell PowerScale OneFS
- CVE-2025-11480SourceCodester Simple E-Commerce Bookstore register.php sql injectionSourceCodester Simple E-Commerce Bookstore
- CVE-2025-11479SourceCodester Wedding Reservation Management System function.php insertReservation sql injectionSourceCodester Wedding Reservation Management System
- CVE-2025-43771Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DLiferay Portal · Liferay DXP +1
- CVE-2025-11478SourceCodester Farm Management System myCart.php sql injectionSourceCodester Farm Management System
- CVE-2025-11477SourceCodester Wedding Reservation Management System global.php sql injectionSourceCodester Wedding Reservation Management System
- CVE-2025-43829Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and LiferLiferay Portal · Liferay DXP +1
- CVE-2025-11476SourceCodester Simple E-Commerce Bookstore index.php sql injectionSourceCodester Simple E-Commerce Bookstore
- CVE-2025-43830Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.QLiferay Portal · Liferay DXP +1
- CVE-2025-11475projectworlds Advanced Library Management System view_member.php sql injectionprojectworlds Advanced Library Management System
- CVE-2025-43821Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and LifeLiferay Portal · Liferay DXP +1
- CVE-2025-11474SourceCodester Hotel and Lodge Management System edit_booking.php sql injectionSourceCodester Hotel and Lodge Management System
- CVE-2025-11473SourceCodester Hotel and Lodge Management System edit_curr.php sql injectionSourceCodester Hotel and Lodge Management System
- CVE-2025-11472SourceCodester Hotel and Lodge Management System edit_room.php sql injectionSourceCodester Hotel and Lodge Management System
- CVE-2025-11471SourceCodester Hotel and Lodge Management System edit_customer.php sql injectionSourceCodester Hotel and Lodge Management System
- CVE-2025-10649Welcart e-Commerce <= 2.11.21 - Authenticated (Author+) SQL Injection via Cookieuscnanbu Welcart e-Commerce
- CVE-2025-11470SourceCodester Hotel and Lodge Management System manage_website.php unrestricted uploadSourceCodester Hotel and Lodge Management System
- CVE-2025-11469SourceCodester Hotel and Lodge Management System save_customer.php sql injectionSourceCodester Hotel and Lodge Management System
- CVE-2025-11445Kilo Code Prompt ClineProvider.ts ClineProvider injectionKilo Code
- CVE-2025-11443JhumanJ OpnForm Forgotten Password email information exposureJhumanJ OpnForm
- CVE-2025-11442JhumanJ OpnForm API Endpoint cross-site request forgeryJhumanJ OpnForm
- CVE-2025-11441JhumanJ OpnForm HTTP Header excessive authenticationJhumanJ OpnForm
- CVE-2025-11440JhumanJ OpnForm edit access controlJhumanJ OpnForm
- CVE-2025-48464Exposure of Sensitive InformationDuckDuckGo Browser
- CVE-2025-11439JhumanJ OpnForm integrations authorizationJhumanJ OpnForm
- CVE-2025-11438JhumanJ OpnForm API Endpoint custom-domains authorizationJhumanJ OpnForm
- CVE-2025-11437JhumanJ OpnForm Form Editor forms cross site scriptingJhumanJ OpnForm
- CVE-2025-11436JhumanJ OpnForm answer unrestricted uploadJhumanJ OpnForm
- CVE-2025-11435JhumanJ OpnForm submissions cross site scriptingJhumanJ OpnForm
- CVE-2025-11171Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Functionays-pro Chartify – WordPress Chart Plugin
- CVE-2025-11434itsourcecode Student Transcript Processing System login.php sql injectionitsourcecode Student Transcript Processing System
- CVE-2025-11433itsourcecode Leave Management System Query Parameter controller.php redirect cross site scriptingitsourcecode Leave Management System
- CVE-2025-11432itsourcecode Leave Management System reset.php sql injectionitsourcecode Leave Management System
- CVE-2025-11431code-projects Web-Based Inventory and POS System transaction.php sql injectioncode-projects Web-Based Inventory and POS System
- CVE-2025-11430SourceCodester Simple E-Commerce Bookstore cart.php sql injectionSourceCodester Simple E-Commerce Bookstore
- CVE-2025-11426projectworlds Advanced Library Management System edit_book.php unrestricted uploadprojectworlds Advanced Library Management System
- CVE-2025-11425projectworlds Advanced Library Management System edit_admin.php cross site scriptingprojectworlds Advanced Library Management System
- CVE-2025-11424code-projects Web-Based Inventory and POS System login.php sql injectioncode-projects Web-Based Inventory and POS System
- CVE-2025-11422Campcodes Advanced Online Voting Management System login.php sql injectionCampcodes Advanced Online Voting Management System
- CVE-2025-11421code-projects Voting System candidates_edit.php cross site scriptingcode-projects Voting System
- CVE-2025-61786Deno's --deny-read check does not prevent permission bypassdenoland deno · deno
- CVE-2025-61785Deno's --deny-write check does not prevent permission bypassdenoland deno · deno
- CVE-2025-11420code-projects E-Commerce Website edit_order_details.php sql injectioncode-projects E-Commerce Website
- CVE-2025-59303HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with HAProxy Kubernetes Ingress Controller
- CVE-2025-60298Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint.
- CVE-2025-60299Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint.
- CVE-2025-60313Sourcecodester Link Status Checker 1.0 is vulnerable to a Cross-Site Scripting (XSS) in the Enter URLs to check input field.
- CVE-2025-60314Configuroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) due to the lack of input sanitization on the
- CVE-2025-60318SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First N
- CVE-2025-60828WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface.
- CVE-2025-60830redragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the default Shiro key.
- CVE-2025-60833An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary cod
- CVE-2025-60834A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input.
- CVE-2025-61183Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of webreinvent/vaahcms