CVEs published October 11, 2025
76 CVEs were published on October 11, 2025: 3 critical, 6 high.
- Published
- 76
- Critical
- 3
- High
- 6
- Medium
- 61
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- Huawei HarmonyOS
- 21
- code-projects Simple Food Ordering System
- 4
- CodeAstro Gym Management System
- 4
- Campcodes Online Apartment Visitor Management System
- 2
- code-projects E-Commerce Website
- 2
- SourceCodester Best Salon Management System
- 2
- SourceCodester Simple Inventory System
- 2
- westerndeal GSheetConnector for Gravity Forms – Send Gravit…
- 2
- accessibewp Web Accessibility by accessiBe
- 1
- ApusTheme WP Freeio
- 1
Critical 3
- CVE-2025-6439WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File DeletionJMA Plugins WooCommerce Designer Pro
- CVE-2025-6553Ovatheme Events Manager <= 1.8.5 - Unauthenticated Arbitrary File UploadOvatheme Events Manager
- CVE-2025-11533WP Freeio <= 1.2.21 - Unauthenticated Privilege EscalationApusTheme WP Freeio
High 6
- CVE-2025-8593GSheetConnector For Gravity Forms <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installationwesterndeal GSheetConnector for Gravity Forms – Send Gravit…
- CVE-2025-58299Use After Free (UAF) vulnerability in the storage management module.Huawei HarmonyOS
- CVE-2025-58298Data processing error vulnerability in the package management module.Huawei HarmonyOS
- CVE-2025-58287Use After Free (UAF) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-31718In modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T606/T612/T616/T750/T765…
- CVE-2025-31717In modem, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. T750/T765/T760/T770/T820…
Medium, low and unrated 67
- CVE-2025-11615SourceCodester Best Salon Management System add_invoice.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-11614SourceCodester Best Salon Management System edit-appointment.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-11613code-projects Simple Food Ordering System addcategory.php sql injectioncode-projects Simple Food Ordering System
- CVE-2025-11612code-projects Simple Food Ordering System addproduct.php sql injectioncode-projects Simple Food Ordering System
- CVE-2025-11611SourceCodester Simple Inventory System user.php sql injectionSourceCodester Simple Inventory System
- CVE-2025-11610SourceCodester Simple Inventory System brand.php sql injectionSourceCodester Simple Inventory System
- CVE-2025-11609code-projects Hospital Management System express-session hard-coded keycode-projects Hospital Management System
- CVE-2025-11608code-projects E-Banking System POST Parameter register.php sql injectioncode-projects E-Banking System
- CVE-2025-11607harry0703 MoneyPrinterTurbo API Endpoint music.py upload_music path traversalharry0703 MoneyPrinterTurbo
- CVE-2025-11606iPynch Social Network Website Search sql injectioniPynch Social Network Website
- CVE-2025-11605code-projects Client Details System update-profile.php sql injectioncode-projects Client Details System
- CVE-2025-11604projectworlds Online Ordering Food System all-orders.php sql injectionprojectworlds Online Ordering Food System
- CVE-2025-11603code-projects Simple Food Ordering System editproduct.php sql injectioncode-projects Simple Food Ordering System
- CVE-2025-11601SourceCodester Online Student Result System login.php sql injectionSourceCodester Online Student Result System
- CVE-2025-11600code-projects Simple Food Ordering System editcategory.php sql injectioncode-projects Simple Food Ordering System
- CVE-2025-11599Campcodes Online Apartment Visitor Management System forgot-password.php sql injectionCampcodes Online Apartment Visitor Management System
- CVE-2025-11597code-projects E-Commerce Website product_add_qty.php sql injectioncode-projects E-Commerce Website
- CVE-2025-11596code-projects E-Commerce Website delete_order_details.php sql injectioncode-projects E-Commerce Website
- CVE-2025-11595Campcodes Online Apartment Visitor Management System admin-profile.php sql injectionCampcodes Online Apartment Visitor Management System
- CVE-2025-10376Course Redirects for Learndash Plugin <= 0.4 - Cross-Site Request Forgeryercbs Course Redirects for Learndash Plugin
- CVE-2025-10129WordPress Live Webcam Widget & Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingmiksco WordPress Live Webcam Widget & Shortcode
- CVE-2025-10375Web Accessibility By accessiBe <= 2.10 - Cross-Site Request Forgeryaccessibewp Web Accessibility by accessiBe
- CVE-2025-9947Custom 404 Pro <= 3.12.0 - Authenticated (Administrator+) SQL Injection via `path` Parameterkunalnagar Custom 404 Pro
- CVE-2025-8606GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivationwesterndeal GSheetConnector for Gravity Forms – Send Gravit…
- CVE-2025-10175WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injectionrico-macchi WP Links Page
- CVE-2025-8484Code Quality Control Tool <= 2.1 - Unauthenticated Information Exposure via Log Filesnickclarkweb Code Quality Control Tool
- CVE-2025-9950Error Log Viewer by BestWebSoft <= 1.1.6 - Authenticated (Administrator+) Arbitrary File ReadError Log Viewer by BestWebSoft
- CVE-2025-8682Newsup <= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installationthemeansar Newsup
- CVE-2025-9626Page Blocks <= 1.1.0 - Cross-Site Request Forgerysoftwud Page Blocks
- CVE-2025-10190WP Easy Toggles <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scriptinghusainahmedqureshi WP Easy Toggles
- CVE-2025-9975WP Scraper <= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgeryrico-macchi WP Scraper
- CVE-2025-7652Easy Plugin Stats <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingndiego Easy Plugin Stats
- CVE-2025-10167Stock History & Reports Manager for WooCommerce <= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpcodefactory Stock History & Reports Manager for WooCommer…
- CVE-2025-9621WidgetPack Comment System <= 1.6.1 - Cross-Site Request ForgeryWidgetPack Comment System
- CVE-2025-58293Vulnerability of improper exception handling in the print module.Huawei HarmonyOS
- CVE-2025-58289Vulnerability of improper exception handling in the print module.Huawei HarmonyOS
- CVE-2025-58301Buffer overflow vulnerability in the device management module.Huawei HarmonyOS
- CVE-2025-58300Buffer overflow vulnerability in the device management module.Huawei HarmonyOS
- CVE-2025-11594ywxbear PHP-Bookstore-Website-Example Quantity index.php improper validation of specified quantity in inputywxbear PHP-Bookstore-Website-Example · ywxbear PHP Basic B…
- CVE-2025-58297Buffer overflow vulnerability in the sensor service.Huawei HarmonyOS
- CVE-2025-58295Buffer overflow vulnerability in the development framework module.Huawei HarmonyOS
- CVE-2025-58292Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-58291Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-58290Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-58288Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-58286Denial of service (DoS) vulnerability in the office service.Huawei HarmonyOS
- CVE-2025-11167CM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirectcreativemindssolutions CM Registration – Tailored tool for…
- CVE-2025-11518WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulationwpclever WPC Smart Wishlist for WooCommerce
- CVE-2025-11254Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.3 - Unauthenticated CSV Injectioncontest-gallery Contest Gallery – Upload & Vote Photos, Med…
- CVE-2025-10185NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injectionwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2025-10048My Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL Injectionwphocus My auctions allegro
- CVE-2025-9196Trinity Audio <= 5.21.0 - Unauthenticated Information Exposuresergiotrinity Trinity Audio – Text to Speech AI audio playe…
- CVE-2025-11197Draft List <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingdartiss Draft List
- CVE-2025-9496Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcodeshortpixel Enable Media Replace
- CVE-2025-11593CodeAstro Gym Management System delete-equipment.php sql injectionCodeAstro Gym Management System
- CVE-2025-11592CodeAstro Gym Management System edit-equipmentform.php sql injectionCodeAstro Gym Management System
- CVE-2025-11591CodeAstro Gym Management System delete-member.php sql injectionCodeAstro Gym Management System
- CVE-2025-58285Permission control vulnerability in the media module.Huawei HarmonyOS
- CVE-2025-58284Permission control vulnerability in the network module.Huawei HarmonyOS
- CVE-2025-58283Permission control vulnerability in the Wi-Fi module.Huawei HarmonyOS
- CVE-2025-58282Permission control vulnerability in the camera module.Huawei HarmonyOS
- CVE-2025-58278Identity authentication bypass vulnerability in the Gallery app.Huawei HarmonyOS
- CVE-2025-58277Permission verification bypass vulnerability in the Camera app.Huawei HarmonyOS
- CVE-2025-11380Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposureeverestthemes Everest Backup – WordPress Cloud Backup, Migr…
- CVE-2025-9560Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcodeextendthemes Colibri Page Builder
- CVE-2025-54654Permission control vulnerability in the Gallery module.Huawei HarmonyOS
- CVE-2025-11590CodeAstro Gym Management System equipment-entry.php sql injectionCodeAstro Gym Management System