# CVEs published 2025-10-08

102 CVEs were published on October 8, 2025: 9 critical, 12 high. Days are UTC.

- [CVE-2025-11513](https://cve.now/CVE-2025-11513.md): code-projects E-Commerce Website supplier\_update.php sql injection (CVSS 6.9, code-projects E-Commerce Website)
- [CVE-2025-11512](https://cve.now/CVE-2025-11512.md): code-projects Voting System voters\_add.php cross site scripting (CVSS 5.3, code-projects Voting System)
- [CVE-2025-11511](https://cve.now/CVE-2025-11511.md): code-projects E-Commerce Website supplier\_add.php sql injection (CVSS 5.3, code-projects E-Commerce Website)
- [CVE-2025-61913](https://cve.now/CVE-2025-61913.md): Flowise is vulnerable to arbitrary file read, arbitrary file write (CVSS 10.0, FlowiseAI Flowise · flowise +1)
- [CVE-2025-11509](https://cve.now/CVE-2025-11509.md): code-projects E-Commerce Website product\_add.php sql injection (CVSS 5.3, code-projects E-Commerce Website)
- [CVE-2025-11508](https://cve.now/CVE-2025-11508.md): code-projects Voting System voters\_add.php unrestricted upload (CVSS 5.1, code-projects Voting System)
- [CVE-2025-11535](https://cve.now/CVE-2025-11535.md): MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories (CVSS 8.8, MongoDB Connector for BI)
- [CVE-2017-20202](https://cve.now/CVE-2017-20202.md): Web Developer for Chrome v0.4.9 Malicious Backdoor Supply Chain Compromise (CVSS 9.3, Web Developer for Chrome)
- [CVE-2017-20201](https://cve.now/CVE-2017-20201.md): CCleaner v5.33.6162 & CCleaner Cloud v1.07.3191 Malicious Backdoor Supply Chain Compromise (CVSS 9.3, Piriform CCleaner)
- [CVE-2025-11507](https://cve.now/CVE-2025-11507.md): PHPGurukul Beauty Parlour Management System search-invoices.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-11506](https://cve.now/CVE-2025-11506.md): PHPGurukul Beauty Parlour Management System search-appointment.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-11505](https://cve.now/CVE-2025-11505.md): PHPGurukul Beauty Parlour Management System new-appointment.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-11503](https://cve.now/CVE-2025-11503.md): PHPGurukul Beauty Parlour Management System manage-services.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-11495](https://cve.now/CVE-2025-11495.md): GNU Binutils Linker elf64-x86-64.c elf\_x86\_64\_relocate\_section heap-based overflow (CVSS 4.8, GNU Binutils)
- [CVE-2025-11494](https://cve.now/CVE-2025-11494.md): GNU Binutils Linker elfxx-x86.c \_bfd\_x86\_elf\_late\_size\_sections out-of-bounds (CVSS 4.8, GNU Binutils)
- [CVE-2025-11491](https://cve.now/CVE-2025-11491.md): wonderwhy-er DesktopCommanderMCP command-manager.ts CommandManager os command injection (CVSS 5.3, wonderwhy-er DesktopCommanderMCP)
- [CVE-2025-11490](https://cve.now/CVE-2025-11490.md): wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injection (CVSS 5.3, wonderwhy-er DesktopCommanderMCP)
- [CVE-2025-61906](https://cve.now/CVE-2025-61906.md): Opencast's editor accidentally publishes videos/overwrites publications #1626 (CVSS 2.3, opencast)
- [CVE-2025-61788](https://cve.now/CVE-2025-61788.md): Opencast Paella Player 7 vulnerable to Cross-Site-Scripting (CVSS 5.1, opencast · org.opencastproject:opencast-common)
- [CVE-2025-11489](https://cve.now/CVE-2025-11489.md): wonderwhy-er DesktopCommanderMCP filesystem.ts isPathAllowed symlink (CVSS 2.0, wonderwhy-er DesktopCommanderMCP)
- [CVE-2025-11488](https://cve.now/CVE-2025-11488.md): D-Link DIR-852 HNAP1 command injection (CVSS 6.9, D-Link DIR-852)
- [CVE-2025-11487](https://cve.now/CVE-2025-11487.md): SourceCodester Farm Management System uploadProduct.php sql injection (CVSS 5.3, SourceCodester Farm Management System)
- [CVE-2025-42701](https://cve.now/CVE-2025-42701.md): CrowdStrike Falcon Sensor for Windows Race Condition (CVSS 5.6, CrowdStrike Falcon sensor for Windows)
- [CVE-2025-42706](https://cve.now/CVE-2025-42706.md): CrowdStrike Falcon Sensor for Windows Logic Error (CVSS 6.5, CrowdStrike Falcon sensor for Windows)
- [CVE-2025-9868](https://cve.now/CVE-2025-9868.md): Nexus Repository 2 - SSRF Vulnerability in Remote Browser Plugin (CVSS 8.7, Sonatype Nexus Repository)
- [CVE-2025-11486](https://cve.now/CVE-2025-11486.md): SourceCodester Farm Management System buyNow.php sql injection (CVSS 5.3, SourceCodester Farm Management System)
- [CVE-2025-11485](https://cve.now/CVE-2025-11485.md): SourceCodester Student Grades Management System Manage Users admin.php add\_user cross site scripting (CVSS 4.8, SourceCodester Student Grades Management System)
- [CVE-2025-9970](https://cve.now/CVE-2025-9970.md): Application credential stored in clear text in memory (CVSS 5.7, ABB MConfig)
- [CVE-2025-11481](https://cve.now/CVE-2025-11481.md): varunsardana004 Blood-Bank-And-Donation-Management-System donate\_blood.php sql injection (CVSS 5.3, varunsardana004 Blood-Bank-And-Donation-Management-System)
- [CVE-2025-5009](https://cve.now/CVE-2025-5009.md): Information Disclosure in Gemini iOS App (CVSS 1.0, Google Gemini)
- [CVE-2025-36636](https://cve.now/CVE-2025-36636.md): Improper Access Control (CVSS 4.3, Tenable Security Center)
- [CVE-2025-61672](https://cve.now/CVE-2025-61672.md): Synapse: Invalid device keys degrade federation functionality (CVSS 5.3, element-hq synapse · matrix-synapse)
- [CVE-2025-43724](https://cve.now/CVE-2025-43724.md): Dell PowerScale OneFS, versions prior to 9.12.0.0, contains an authorization bypass through user-controlled key vulnerability. (CVSS 4.4, Dell PowerScale OneFS)
- [CVE-2025-11480](https://cve.now/CVE-2025-11480.md): SourceCodester Simple E-Commerce Bookstore register.php sql injection (CVSS 6.9, SourceCodester Simple E-Commerce Bookstore)
- [CVE-2025-11479](https://cve.now/CVE-2025-11479.md): SourceCodester Wedding Reservation Management System function.php insertReservation sql injection (CVSS 6.9, SourceCodester Wedding Reservation Management System)
- [CVE-2025-43771](https://cve.now/CVE-2025-43771.md): Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay D (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11478](https://cve.now/CVE-2025-11478.md): SourceCodester Farm Management System myCart.php sql injection (CVSS 5.3, SourceCodester Farm Management System)
- [CVE-2025-11477](https://cve.now/CVE-2025-11477.md): SourceCodester Wedding Reservation Management System global.php sql injection (CVSS 6.9, SourceCodester Wedding Reservation Management System)
- [CVE-2025-43829](https://cve.now/CVE-2025-43829.md): Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Lifer (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11476](https://cve.now/CVE-2025-11476.md): SourceCodester Simple E-Commerce Bookstore index.php sql injection (CVSS 6.9, SourceCodester Simple E-Commerce Bookstore)
- [CVE-2025-43830](https://cve.now/CVE-2025-43830.md): Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11475](https://cve.now/CVE-2025-11475.md): projectworlds Advanced Library Management System view\_member.php sql injection (CVSS 6.9, projectworlds Advanced Library Management System)
- [CVE-2025-43821](https://cve.now/CVE-2025-43821.md): Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Life (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11474](https://cve.now/CVE-2025-11474.md): SourceCodester Hotel and Lodge Management System edit\_booking.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11473](https://cve.now/CVE-2025-11473.md): SourceCodester Hotel and Lodge Management System edit\_curr.php sql injection (CVSS 6.9, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11472](https://cve.now/CVE-2025-11472.md): SourceCodester Hotel and Lodge Management System edit\_room.php sql injection (CVSS 6.9, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11471](https://cve.now/CVE-2025-11471.md): SourceCodester Hotel and Lodge Management System edit\_customer.php sql injection (CVSS 6.9, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-10649](https://cve.now/CVE-2025-10649.md): Welcart e-Commerce \<= 2.11.21 - Authenticated (Author+) SQL Injection via Cookie (CVSS 6.5, uscnanbu Welcart e-Commerce)
- [CVE-2025-10353](https://cve.now/CVE-2025-10353.md): Missing Authorization vulnerability in Melis Platform (CVSS 9.3, Melis Technology Melis Platform · melisplatform/melis-cms-s…)
- [CVE-2025-10352](https://cve.now/CVE-2025-10352.md): Missing Authorization vulnerability in Melis Platform (CVSS 9.3, Melis Technology Melis Platform · melisplatform/melis-core)
- [CVE-2025-10351](https://cve.now/CVE-2025-10351.md): SQL injection vulnerability in Melis Platform (CVSS 9.3, Melis Technology Melis Platform · melisplatform/melis-cms)
- [CVE-2025-11470](https://cve.now/CVE-2025-11470.md): SourceCodester Hotel and Lodge Management System manage\_website.php unrestricted upload (CVSS 5.1, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11469](https://cve.now/CVE-2025-11469.md): SourceCodester Hotel and Lodge Management System save\_customer.php sql injection (CVSS 5.3, SourceCodester Hotel and Lodge Management System)
- [CVE-2025-11445](https://cve.now/CVE-2025-11445.md): Kilo Code Prompt ClineProvider.ts ClineProvider injection (CVSS 5.3, Kilo Code)
- [CVE-2025-11444](https://cve.now/CVE-2025-11444.md): TOTOLINK N600R HTTP Request cstecgi.cgi setWiFiBasicConfig buffer overflow (CVSS 8.7, TOTOLINK N600R)
- [CVE-2025-11443](https://cve.now/CVE-2025-11443.md): JhumanJ OpnForm Forgotten Password email information exposure (CVSS 6.3, JhumanJ OpnForm)
- [CVE-2025-11442](https://cve.now/CVE-2025-11442.md): JhumanJ OpnForm API Endpoint cross-site request forgery (CVSS 5.3, JhumanJ OpnForm)
- [CVE-2025-11441](https://cve.now/CVE-2025-11441.md): JhumanJ OpnForm HTTP Header excessive authentication (CVSS 6.3, JhumanJ OpnForm)
- [CVE-2025-11440](https://cve.now/CVE-2025-11440.md): JhumanJ OpnForm edit access control (CVSS 5.3, JhumanJ OpnForm)
- [CVE-2025-48464](https://cve.now/CVE-2025-48464.md): Exposure of Sensitive Information (CVSS 4.7, DuckDuckGo Browser)
- [CVE-2025-11439](https://cve.now/CVE-2025-11439.md): JhumanJ OpnForm integrations authorization (CVSS 5.3, JhumanJ OpnForm)
- [CVE-2025-11438](https://cve.now/CVE-2025-11438.md): JhumanJ OpnForm API Endpoint custom-domains authorization (CVSS 5.3, JhumanJ OpnForm)
- [CVE-2025-11437](https://cve.now/CVE-2025-11437.md): JhumanJ OpnForm Form Editor forms cross site scripting (CVSS 4.8, JhumanJ OpnForm)
- [CVE-2025-10635](https://cve.now/CVE-2025-10635.md): Find Me On \<= 2.0.9.1 - Subscriber+ SQL Injection (CVSS 7.7, Find Me On)
- [CVE-2025-11436](https://cve.now/CVE-2025-11436.md): JhumanJ OpnForm answer unrestricted upload (CVSS 5.3, JhumanJ OpnForm)
- [CVE-2025-11435](https://cve.now/CVE-2025-11435.md): JhumanJ OpnForm submissions cross site scripting (CVSS 5.3, JhumanJ OpnForm)
- [CVE-2025-11171](https://cve.now/CVE-2025-11171.md): Chartify – WordPress Chart Plugin \<= 3.5.9 - Missing Authentication for Administrative Function (CVSS 5.3, ays-pro Chartify – WordPress Chart Plugin)
- [CVE-2025-11434](https://cve.now/CVE-2025-11434.md): itsourcecode Student Transcript Processing System login.php sql injection (CVSS 6.9, itsourcecode Student Transcript Processing System)
- [CVE-2025-11433](https://cve.now/CVE-2025-11433.md): itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting (CVSS 5.1, itsourcecode Leave Management System)
- [CVE-2025-11432](https://cve.now/CVE-2025-11432.md): itsourcecode Leave Management System reset.php sql injection (CVSS 6.9, itsourcecode Leave Management System)
- [CVE-2025-11204](https://cve.now/CVE-2025-11204.md): RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login \<= 6.0.6.2 - Authenticated (Administrator+) SQL Injection (CVSS 7.2, metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2025-11431](https://cve.now/CVE-2025-11431.md): code-projects Web-Based Inventory and POS System transaction.php sql injection (CVSS 5.3, code-projects Web-Based Inventory and POS System)
- [CVE-2025-11430](https://cve.now/CVE-2025-11430.md): SourceCodester Simple E-Commerce Bookstore cart.php sql injection (CVSS 6.9, SourceCodester Simple E-Commerce Bookstore)
- [CVE-2025-10587](https://cve.now/CVE-2025-10587.md): Community Events \<= 1.5.1 - Unauthenticated SQL Injection (CVSS 9.8, jackdewey Community Events)
- [CVE-2025-10494](https://cve.now/CVE-2025-10494.md): Motors – Car Dealership & Classified Listings Plugin \<= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2025-11426](https://cve.now/CVE-2025-11426.md): projectworlds Advanced Library Management System edit\_book.php unrestricted upload (CVSS 5.3, projectworlds Advanced Library Management System)
- [CVE-2025-11425](https://cve.now/CVE-2025-11425.md): projectworlds Advanced Library Management System edit\_admin.php cross site scripting (CVSS 4.8, projectworlds Advanced Library Management System)
- [CVE-2025-11424](https://cve.now/CVE-2025-11424.md): code-projects Web-Based Inventory and POS System login.php sql injection (CVSS 6.9, code-projects Web-Based Inventory and POS System)
- [CVE-2025-11423](https://cve.now/CVE-2025-11423.md): Tenda CH22 SafeEmailFilter formSafeEmailFilter memory corruption (CVSS 9.3, Tenda CH22)
- [CVE-2025-11422](https://cve.now/CVE-2025-11422.md): Campcodes Advanced Online Voting Management System login.php sql injection (CVSS 6.9, Campcodes Advanced Online Voting Management System)
- [CVE-2025-11421](https://cve.now/CVE-2025-11421.md): code-projects Voting System candidates\_edit.php cross site scripting (CVSS 5.1, code-projects Voting System)
- [CVE-2025-61787](https://cve.now/CVE-2025-61787.md): Deno is Vulnerable to Command Injection on Windows During Batch File Execution (CVSS 8.1, denoland deno · deno)
- [CVE-2025-61786](https://cve.now/CVE-2025-61786.md): Deno's --deny-read check does not prevent permission bypass (CVSS 3.3, denoland deno · deno)
- [CVE-2025-48981](https://cve.now/CVE-2025-48981.md): An insecure implementation of the proprietary protocol DNET in Product CGM MEDICO allows attackers within the intranet to eavesdrop and mani (CVSS 8.6, CompuGroup Medical CGM MEDICO)
- [CVE-2025-61785](https://cve.now/CVE-2025-61785.md): Deno's --deny-write check does not prevent permission bypass (CVSS 3.3, denoland deno · deno)
- [CVE-2025-11420](https://cve.now/CVE-2025-11420.md): code-projects E-Commerce Website edit\_order\_details.php sql injection (CVSS 6.9, code-projects E-Commerce Website)
- [CVE-2025-11418](https://cve.now/CVE-2025-11418.md): Tenda CH22 HTTP Request AdvSetWrlsafeset formWrlsafeset stack-based overflow (CVSS 9.3, Tenda CH22)
- [CVE-2025-53967](https://cve.now/CVE-2025-53967.md): Framelink Figma MCP Server before 0.6.3 allows an unauthenticated remote attacker to execute arbitrary operating system commands via a craft (CVSS 8.0, Framelink Figma MCP Server · figma-developer-mcp)
- [CVE-2025-57457](https://cve.now/CVE-2025-57457.md): An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Command (CVSS 8.8)
- [CVE-2025-59303](https://cve.now/CVE-2025-59303.md): HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with (CVSS 6.4, HAProxy Kubernetes Ingress Controller)
- [CVE-2025-60298](https://cve.now/CVE-2025-60298.md): Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. (CVSS 5.4)
- [CVE-2025-60299](https://cve.now/CVE-2025-60299.md): Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint. (CVSS 5.4)
- [CVE-2025-60311](https://cve.now/CVE-2025-60311.md): ProjectWorlds Gym Management System1.0 is vulnerable to SQL Injection via the "id" parameter in the profile/edit.php page (CVSS 8.8)
- [CVE-2025-60313](https://cve.now/CVE-2025-60313.md): Sourcecodester Link Status Checker 1.0 is vulnerable to a Cross-Site Scripting (XSS) in the Enter URLs to check input field. (CVSS 6.1)
- [CVE-2025-60314](https://cve.now/CVE-2025-60314.md): Configuroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) due to the lack of input sanitization on the (CVSS 5.4)
- [CVE-2025-60318](https://cve.now/CVE-2025-60318.md): SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First N (CVSS 6.1)
- [CVE-2025-60828](https://cve.now/CVE-2025-60828.md): WukongCRM-9.0-JAVA was discovered to contain a fastjson deserialization vulnerability via the /OaExamine/setOaExamine interface. (CVSS 6.5)
- [CVE-2025-60830](https://cve.now/CVE-2025-60830.md): redragon-erp v1.0 was discovered to contain a Shiro deserialization vulnerability caused by the default Shiro key. (CVSS 6.5)
- [CVE-2025-60833](https://cve.now/CVE-2025-60833.md): An XML External Entity (XXE) vulnerability in the /mall/wxpay/pay component of uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary cod (CVSS 6.5)
- [CVE-2025-60834](https://cve.now/CVE-2025-60834.md): A fastjson deserialization vulnerability in uzy-ssm-mall v1.1.0 allows attackers to execute arbitrary code via supplying a crafted input. (CVSS 6.5)
- [CVE-2025-61183](https://cve.now/CVE-2025-61183.md): Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of (CVSS 6.1, webreinvent/vaahcms)
- [CVE-2025-61524](https://cve.now/CVE-2025-61524.md): An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v. (CVSS 7.2, github.com/casdoor/casdoor)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.