# CVEs published 2025-10-10

124 CVEs were published on October 10, 2025: 4 critical, 39 high. Days are UTC.

- [CVE-2025-11626](https://cve.now/CVE-2025-11626.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.5, Wireshark Foundation Wireshark)
- [CVE-2025-9554](https://cve.now/CVE-2025-9554.md): Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104 (CVSS 5.3, Drupal Owl Carousel · drupal/owlcarousel2)
- [CVE-2025-62162](https://cve.now/CVE-2025-62162.md): cel-rust May Panic During Parsing of Invalid CEL Expressions (CVSS 7.5, cel-rust · cel)
- [CVE-2025-9553](https://cve.now/CVE-2025-9553.md): API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103 (CVSS 5.3, Drupal API Key manager · drupal/api\_key\_manager)
- [CVE-2025-9552](https://cve.now/CVE-2025-9552.md): Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102 (CVSS 5.3, Drupal Synchronize composer.json With Contrib Modules · dru…)
- [CVE-2025-9551](https://cve.now/CVE-2025-9551.md): Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101 (CVSS 6.5, Drupal Protected Pages · drupal/protected\_pages)
- [CVE-2025-9550](https://cve.now/CVE-2025-9550.md): Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100 (CVSS 6.1, Drupal Facets · drupal/facets)
- [CVE-2025-9549](https://cve.now/CVE-2025-9549.md): Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099 (CVSS 6.5, Drupal Facets · drupal/facets)
- [CVE-2025-8093](https://cve.now/CVE-2025-8093.md): Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098 (CVSS 8.8, Drupal Authenticator Login · drupal/alogin)
- [CVE-2025-62159](https://cve.now/CVE-2025-62159.md): External Secrets Operator's BeyondTrust Provider has Insecure Secret Retrieval (CVSS 8.7, external-secrets)
- [CVE-2025-52647](https://cve.now/CVE-2025-52647.md): HCL BigFix WebUI is affected by a host header poisoning vulnerability (CVSS 6.1, HCL Software BigFix WebUI)
- [CVE-2025-52885](https://cve.now/CVE-2025-52885.md): GHSL-2025-042: Poppler has Use-After-Free (CVSS 6.1, poppler)
- [CVE-2025-61912](https://cve.now/CVE-2025-61912.md): python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination (CVSS 5.5, python-ldap)
- [CVE-2025-61911](https://cve.now/CVE-2025-61911.md): python-ldap has sanitization bypass in ldap.filter.escape\_filter\_chars (CVSS 5.5, python-ldap)
- [CVE-2025-11589](https://cve.now/CVE-2025-11589.md): CodeAstro Gym Management System user-payment.php sql injection (CVSS 5.3, CodeAstro Gym Management System)
- [CVE-2025-11588](https://cve.now/CVE-2025-11588.md): CodeAstro Gym Management System index.php sql injection (CVSS 5.3, CodeAstro Gym Management System)
- [CVE-2025-11586](https://cve.now/CVE-2025-11586.md): Tenda AC7 setNotUpgrade stack-based overflow (CVSS 8.7, Tenda AC7)
- [CVE-2025-11585](https://cve.now/CVE-2025-11585.md): code-projects Project Monitoring System useredit.php sql injection (CVSS 6.9, code-projects Project Monitoring System)
- [CVE-2025-11584](https://cve.now/CVE-2025-11584.md): code-projects Online Job Search Engine searchjob.php sql injection (CVSS 6.9, code-projects Online Job Search Engine)
- [CVE-2025-62158](https://cve.now/CVE-2025-62158.md): Frappe had attachments made by students to their assignments of type Text set to public (CVSS 2.7, frappe lms)
- [CVE-2025-11583](https://cve.now/CVE-2025-11583.md): code-projects Online Job Search Engine postjob.php sql injection (CVSS 6.9, code-projects Online Job Search Engine)
- [CVE-2025-11582](https://cve.now/CVE-2025-11582.md): code-projects Online Job Search Engine registration.php sql injection (CVSS 6.9, code-projects Online Job Search Engine)
- [CVE-2025-61930](https://cve.now/CVE-2025-61930.md): Emlog Pro has CSRF issue that Enables Admin Password Reset (CVSS 8.1, emlog)
- [CVE-2025-61929](https://cve.now/CVE-2025-61929.md): Cherry Studio allows one-click on a specific URL to cause a command to execute (CVSS 9.7, CherryHQ cherry-studio)
- [CVE-2025-61927](https://cve.now/CVE-2025-61927.md): Happy-DOM has VM Context Escape (CVSS 7.2, capricorn86 happy-dom · happy-dom)
- [CVE-2025-61925](https://cve.now/CVE-2025-61925.md): Astro's \`X-Forwarded-Host\` is reflected with no validation (CVSS 6.5, withastro astro · astro)
- [CVE-2025-61921](https://cve.now/CVE-2025-61921.md): Sinatra has ReDoS vulnerability in ETag header value generation (CVSS 2.7, sinatra)
- [CVE-2025-61920](https://cve.now/CVE-2025-61920.md): Authlib is vulnerable to Denial of Service via Oversized JOSE Segments (CVSS 7.5, authlib)
- [CVE-2025-61919](https://cve.now/CVE-2025-61919.md): Rack is vulnerable to a memory-exhaustion DoS through unbounded URL-encoded body parsing (CVSS 7.5, rack)
- [CVE-2025-62245](https://cve.now/CVE-2025-62245.md): Cross-site request forgery (CSRF) vulnerability in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023 (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-11581](https://cve.now/CVE-2025-11581.md): PowerJob OpenAPIController runJob authorization (CVSS 6.9, PowerJob · tech.powerjob:powerjob-server-starter)
- [CVE-2025-11580](https://cve.now/CVE-2025-11580.md): PowerJob list authorization (CVSS 6.9, PowerJob · tech.powerjob:powerjob)
- [CVE-2025-23282](https://cve.now/CVE-2025-23282.md): NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to use a race condition to escalate privileges. (CVSS 7.0, NVIDIA Virtual GPU Manager · NVIDIA GeForce +3)
- [CVE-2025-23280](https://cve.now/CVE-2025-23280.md): NVIDIA Display Driver for Linux contains a vulnerability where an attacker could cause a use-after-free. (CVSS 7.0, NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +2)
- [CVE-2025-23309](https://cve.now/CVE-2025-23309.md): NVIDIA Display Driver contains a vulnerability where an uncontrolled DLL loading path might lead to arbitrary denial of service, escalation (CVSS 8.2, NVIDIA GeForce · NVIDIA RTX, Quadro, NVS +1)
- [CVE-2025-11618](https://cve.now/CVE-2025-11618.md): Invalid Pointer Dereference when receiving UDP/IPv6 packets in FreeRTOS-Plus-TCP (CVSS 5.3, AWS FreeRTOS-Plus-TCP)
- [CVE-2025-11617](https://cve.now/CVE-2025-11617.md): Buffer Over-read when receiving IPv6 packets with incorrect payload length in FreeRTOS-Plus-TCP (CVSS 5.3, AWS FreeRTOS-Plus-TCP)
- [CVE-2025-11616](https://cve.now/CVE-2025-11616.md): Buffer Over-read when receiving improperly sized ICMPv6 packets in FreeRTOS-Plus-TCP (CVSS 5.3, AWS FreeRTOS-Plus\_TCP)
- [CVE-2025-61780](https://cve.now/CVE-2025-61780.md): Rack has Possible Information Disclosure Vulnerability (CVSS 5.8, rack)
- [CVE-2025-61689](https://cve.now/CVE-2025-61689.md): HTTP.jl vulnerable to Header injection/Response splitting via header construction. (CVSS 8.7, JuliaWeb HTTP.jl)
- [CVE-2025-59530](https://cve.now/CVE-2025-59530.md): quic-go has Client Crash Due to Premature HANDSHAKE\_DONE Frame (CVSS 7.5, quic-go · github.com/quic-go/quic-go)
- [CVE-2025-48043](https://cve.now/CVE-2025-48043.md): Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization (CVSS 8.6, ash-project ash)
- [CVE-2025-8887](https://cve.now/CVE-2025-8887.md): IDOR in Usta Information Systems' Aybs Interaktif (CVSS 6.1, Usta Information Systems Aybs Interaktif)
- [CVE-2025-8886](https://cve.now/CVE-2025-8886.md): Authorization Bypass in Usta Information Systems' Aybs Interaktif (CVSS 6.7, Usta Information Systems Aybs Interaktif)
- [CVE-2025-62237](https://cve.now/CVE-2025-62237.md): Stored cross-site scripting (XSS) vulnerability in Commerce’s view order page in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2 (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-62238](https://cve.now/CVE-2025-62238.md): Stored cross-site scripting (XSS) vulnerability on the Membership page in Account Settings in Liferay Portal 7.4.3.21 through 7.4.3.111, and (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-62239](https://cve.now/CVE-2025-62239.md): Cross-site scripting (XSS) vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 (CVSS 4.6, Liferay Portal · Liferay DXP +1)
- [CVE-2025-7374](https://cve.now/CVE-2025-7374.md): WP JobHunt \<= 7.6 Authenticated (Custom+) Authorization Bypass (CVSS 5.4, WP JobHunt)
- [CVE-2025-7781](https://cve.now/CVE-2025-7781.md): WP JobHunt \<= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs\_job\_title’ (CVSS 6.4, WP JobHunt)
- [CVE-2025-11579](https://cve.now/CVE-2025-11579.md): DoS via Out Of Memory Crash (CVSS 5.3, nwaples rardecode · github.com/nwaples/rardecode +1)
- [CVE-2025-61864](https://cve.now/CVE-2025-61864.md): A use after free vulnerability exists in VS6ComFile!load\_link\_inf of V-SFT v6.2.7.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2025-11190](https://cve.now/CVE-2025-11190.md): CVE-2025-11190 (CVSS 5.4, Synchroweb Kiwire)
- [CVE-2025-11189](https://cve.now/CVE-2025-11189.md): CVE-2025-11189 (CVSS 7.3, Synchroweb Kiwire)
- [CVE-2025-11188](https://cve.now/CVE-2025-11188.md): CVE-2025-11188 (CVSS 7.3, Synchroweb Kiwire)
- [CVE-2025-61863](https://cve.now/CVE-2025-61863.md): An out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::delete\_mem of V-SFT v6.2.7.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2025-61862](https://cve.now/CVE-2025-61862.md): An out-of-bounds read vulnerability exists in VS6ComFile!get\_ovlp\_element\_size of V-SFT v6.2.7.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2025-61861](https://cve.now/CVE-2025-61861.md): An out-of-bounds read vulnerability exists in VS6ComFile!load\_link\_inf of V-SFT v6.2.7.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2025-61860](https://cve.now/CVE-2025-61860.md): An out-of-bounds read vulnerability exists in VS6MemInIF!set\_temp\_type\_default of V-SFT v6.2.7.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2025-61859](https://cve.now/CVE-2025-61859.md): An out-of-bounds write vulnerability exists in VS6ComFile!CItemDraw::is\_motion\_tween of V-SFT v6.2.7.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2025-61857](https://cve.now/CVE-2025-61857.md): An out-of-bounds write vulnerability exists in VS6ComFile!CItemExChange::WinFontDynStrCheck of V-SFT v6.2.7.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2025-52625](https://cve.now/CVE-2025-52625.md): HCL AION is susceptible to Cacheable SSL Page Found vulnerability (CVSS 3.7, HCL AION)
- [CVE-2025-61858](https://cve.now/CVE-2025-61858.md): An out-of-bounds write vulnerability exists in VS6ComFile!set\_AnimationItem of V-SFT v6.2.7.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2025-52624](https://cve.now/CVE-2025-52624.md): HCL AION is susceptible to Bypass of the script allow list configuration vulnerability (CVSS 5.4, HCL AION)
- [CVE-2025-52635](https://cve.now/CVE-2025-52635.md): HCL AION is susceptible to Trusted types in scripts not enforced in CSP (CVSS 3.7, HCL AION)
- [CVE-2025-61856](https://cve.now/CVE-2025-61856.md): A stack-based buffer overflow vulnerability exists in VS6ComFile!CV7BaseMap::WriteV7DataToRom of V-SFT v6.2.7.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. / Hakko Electronics Co. V-SFT)
- [CVE-2025-52632](https://cve.now/CVE-2025-52632.md): HCL AION is susceptible to Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability (CVSS 6.5, HCL AION)
- [CVE-2025-37727](https://cve.now/CVE-2025-37727.md): Elasticsearch Insertion of sensitive information in log file (CVSS 5.7, Elasticsearch · org.elasticsearch.plugin:reindex-client)
- [CVE-2025-52630](https://cve.now/CVE-2025-52630.md): HCL AION is susceptible to Missing or insecure "X-Content-Type-Options" header vulnerability (CVSS 3.7, HCL AION)
- [CVE-2025-25017](https://cve.now/CVE-2025-25017.md): Kibana Stored Cross-Site Scripting (XSS) (CVSS 8.2, Elastic Kibana)
- [CVE-2025-30001](https://cve.now/CVE-2025-30001.md): Apache StreamPark: Authenticated users can trigger remote command execution (CVSS 7.3, Apache Software Foundation Apache StreamPark · org.apache.s…)
- [CVE-2025-25018](https://cve.now/CVE-2025-25018.md): Kibana Stored Cross-Site Scripting (XSS) (CVSS 8.7, Elastic Kibana)
- [CVE-2025-52634](https://cve.now/CVE-2025-52634.md): HCL AION is susceptible to Spring Boot Actuator Endpoints Exposed (CVSS 3.7, HCL AION)
- [CVE-2025-52650](https://cve.now/CVE-2025-52650.md): HCL AION is susceptible to Inline script execution allowed in CSP vulnerability (CVSS 8.2, HCL AION)
- [CVE-2025-41089](https://cve.now/CVE-2025-41089.md): Reflected Cross-Site Scripting (XSS) in CMS (CVSS 4.8, Xibo Signage Xibo CMS)
- [CVE-2025-41088](https://cve.now/CVE-2025-41088.md): Stored Cross-Site Scripting (XSS) in CMS (CVSS 5.1, Xibo Signage Xibo CMS)
- [CVE-2025-52655](https://cve.now/CVE-2025-52655.md): HCL MyXalytics is affected by a Cross-Domain Script Include vulnerability. (CVSS 3.1, HCL MyXalytics)
- [CVE-2025-40640](https://cve.now/CVE-2025-40640.md): Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker (CVSS 5.1, Status Tracker Energy CRM)
- [CVE-2025-21050](https://cve.now/CVE-2025-21050.md): Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles. (CVSS 7.1, Samsung Mobile Devices)
- [CVE-2025-21070](https://cve.now/CVE-2025-21070.md): Out-of-bounds write in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to write out-of-bounds memory. (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2025-21069](https://cve.now/CVE-2025-21069.md): Out-of-bounds read in the parsing of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds m (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2025-21068](https://cve.now/CVE-2025-21068.md): Out-of-bounds read in the reading of image data in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds m (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2025-21067](https://cve.now/CVE-2025-21067.md): Out-of-bounds read in the allocation of image buffer in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bou (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2025-21066](https://cve.now/CVE-2025-21066.md): Out-of-bounds read in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory. (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2025-21065](https://cve.now/CVE-2025-21065.md): Improper input validation in Retail Mode prior to version 5.59.11 allows self attackers to execute privileged commands on their own devices. (CVSS 6.6, Samsung Mobile Retail Mode)
- [CVE-2025-21064](https://cve.now/CVE-2025-21064.md): Improper authentication in Smart Switch prior to version 3.7.66.6 allows adjacent attackers to access transferring data. (CVSS 8.8, Samsung Mobile Smart Switch)
- [CVE-2025-21063](https://cve.now/CVE-2025-21063.md): Improper access control in Samsung Voice Recorder prior to version 21.5.73.12 in Android 15 and 21.5.81.40 in Android 16 allows physical att (CVSS 4.6, Samsung Mobile Samsung Voice Recorder)
- [CVE-2025-21062](https://cve.now/CVE-2025-21062.md): Use of a broken or risky cryptographic algorithm in Smart Switch prior to version 3.7.67.2 allows local attackers to replace the restoring a (CVSS 7.8, Samsung Mobile Smart Switch)
- [CVE-2025-21061](https://cve.now/CVE-2025-21061.md): Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access sensitive data. (CVSS 7.1, Samsung Mobile Smart Switch)
- [CVE-2025-21060](https://cve.now/CVE-2025-21060.md): Cleartext storage of sensitive information in Smart Switch prior to version 3.7.67.2 allows local attackers to access backup data from appli (CVSS 5.5, Samsung Mobile Smart Switch)
- [CVE-2025-21059](https://cve.now/CVE-2025-21059.md): Improper authorization in Samsung Health prior to version 6.30.5.105 allows local attackers to access data in Samsung Health. (CVSS 6.2, Samsung Mobile Samsung Health)
- [CVE-2025-21058](https://cve.now/CVE-2025-21058.md): Improper access control in Routines prior to version 4.8.7.1 in Android 15 and 4.9.6.0 in Android 16 allows local attackers to potentially e (CVSS 7.3, Samsung Mobile Routines)
- [CVE-2025-21057](https://cve.now/CVE-2025-21057.md): Use of implicit intent for sensitive communication in Samsung Notes prior to version 4.4.30.63 allows local attackers to access shared notes (CVSS 4.0, Samsung Mobile Samsung Notes)
- [CVE-2025-21055](https://cve.now/CVE-2025-21055.md): Out-of-bounds read and write in libimagecodec.quram.so prior to SMR Oct-2025 Release 1 allows remote attackers to access out-of-bounds memor (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2025-21054](https://cve.now/CVE-2025-21054.md): Out-of-bounds read in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to potential (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21053](https://cve.now/CVE-2025-21053.md): Out-of-bounds write in the parsing header for JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to cause me (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21052](https://cve.now/CVE-2025-21052.md): Out-of-bounds write under specific condition in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows loc (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21051](https://cve.now/CVE-2025-21051.md): Out-of-bounds write in the pre-processing of JPEG decoding in libpadm.so prior to SMR Oct-2025 Release 1 allows local attackers to write out (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21049](https://cve.now/CVE-2025-21049.md): Improper access control in SecSettings prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive information. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2025-21048](https://cve.now/CVE-2025-21048.md): Relative path traversal in Knox Enterprise prior to SMR Oct-2025 Release 1 allows local attackers to execute arbitrary code. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2025-21047](https://cve.now/CVE-2025-21047.md): Improper access control in KnoxGuard prior to SMR Oct-2025 Release 1 allows physical attackers to use the privileged APIs. (CVSS 5.2, Samsung Mobile Devices)
- [CVE-2025-21046](https://cve.now/CVE-2025-21046.md): Improper access control in WindowManager in Samsung DeX prior to SMR Oct-2025 Release 1 allows physical attackers to temporarily access to r (CVSS 2.4, Samsung Mobile Devices)
- [CVE-2025-21045](https://cve.now/CVE-2025-21045.md): Insecure storage of sensitive information in Galaxy Watch prior to SMR Oct-2025 Release 1 allows local attackers to access sensitive informa (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-21044](https://cve.now/CVE-2025-21044.md): Out-of-bounds write in fingerprint trustlet prior to SMR Oct-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. (CVSS 5.7, Samsung Mobile Devices)
- [CVE-2025-10124](https://cve.now/CVE-2025-10124.md): Booking Manager \< 2.1.15 - Contributor+ Booking Deletion (CVSS 4.5, Booking Manager)
- [CVE-2025-11570](https://cve.now/CVE-2025-11570.md): Versions of the package drupal-pattern-lab/unified-twig-extensions from 0.0.0 are vulnerable to Cross-site Scripting (XSS) due to insufficie (CVSS 4.8, drupal-pattern-lab/unified-twig-extensions)
- [CVE-2025-61871](https://cve.now/CVE-2025-61871.md): NAS Navigator2 Windows version by BUFFALO INC. (CVSS 6.7, BUFFALO NAS Navigator2)
- [CVE-2025-11449](https://cve.now/CVE-2025-11449.md): Reflected Cross Site Scripting in ServiceNow AI Platform (CVSS 5.3, ServiceNow AI Platform)
- [CVE-2025-11450](https://cve.now/CVE-2025-11450.md): Reflected Cross Site Scripting in ServiceNow AI Platform (CVSS 5.3, ServiceNow AI Platform)
- [CVE-2025-55903](https://cve.now/CVE-2025-55903.md): A HTML injection vulnerability exists in Perfex CRM v3.3.1. (CVSS 8.3)
- [CVE-2025-60268](https://cve.now/CVE-2025-60268.md): An arbitrary file upload vulnerability exists in JeeWMS 20250820, which is caused by the lack of file checking in the saveFiles function in (CVSS 6.5)
- [CVE-2025-60269](https://cve.now/CVE-2025-60269.md): JEEWMS 20250820 is vulnerable to SQL Injection in the exportXls function located in the src/main/java/org/jeecgframework/web/cgreport/contro (CVSS 9.4)
- [CVE-2025-60305](https://cve.now/CVE-2025-60305.md): SourceCodester Online Student Clearance System 1.0 is vulnerable to Incorrect Access Control. (CVSS 8.8)
- [CVE-2025-60306](https://cve.now/CVE-2025-60306.md): code-projects Simple Car Rental System 1.0 has a permission bypass issue where low privilege users can forge high privilege sessions and per (CVSS 9.9)
- [CVE-2025-60307](https://cve.now/CVE-2025-60307.md): code-projects Computer Laboratory System 1.0 has a SQL injection vulnerability, where entering a universal password in the Password field on (CVSS 9.8)
- [CVE-2025-60308](https://cve.now/CVE-2025-60308.md): code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the onli (CVSS 4.1)
- [CVE-2025-60378](https://cve.now/CVE-2025-60378.md): Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. (CVSS 8.1)
- [CVE-2025-60838](https://cve.now/CVE-2025-60838.md): An arbitrary file upload vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary code via uploading a crafted file. (CVSS 6.5)
- [CVE-2025-60868](https://cve.now/CVE-2025-60868.md): The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabl (CVSS 6.5, alt-design/alt-redirect)
- [CVE-2025-60869](https://cve.now/CVE-2025-60869.md): Publii CMS v0.46.5 (build 17089) allows persistent Cross-Site Scripting (XSS) via unsanitized input in configuration fields such as "Site De (CVSS 7.3)
- [CVE-2025-60880](https://cve.now/CVE-2025-60880.md): An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a (CVSS 8.3, bagisto/bagisto)
- [CVE-2025-61152](https://cve.now/CVE-2025-61152.md): python-jose thru 3.3.0 allows JWT tokens with 'alg=none' to be decoded and accepted without any cryptographic signature verification. (CVSS 6.5)
- [CVE-2025-61319](https://cve.now/CVE-2025-61319.md): ReNgine thru 2.2.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in the Vulnerabilities module. (CVSS 6.1)
- [CVE-2025-61505](https://cve.now/CVE-2025-61505.md): e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the \`install.php\` script. (CVSS 6.5)
- [CVE-2025-62292](https://cve.now/CVE-2025-62292.md): In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/use (CVSS 4.3, SonarSource SonarQube)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.