# CVEs published 2025-10-11

76 CVEs were published on October 11, 2025: 3 critical, 6 high. Days are UTC.

- [CVE-2025-11615](https://cve.now/CVE-2025-11615.md): SourceCodester Best Salon Management System add\_invoice.php sql injection (CVSS 6.9, SourceCodester Best Salon Management System)
- [CVE-2025-11614](https://cve.now/CVE-2025-11614.md): SourceCodester Best Salon Management System edit-appointment.php sql injection (CVSS 6.9, SourceCodester Best Salon Management System)
- [CVE-2025-11613](https://cve.now/CVE-2025-11613.md): code-projects Simple Food Ordering System addcategory.php sql injection (CVSS 5.3, code-projects Simple Food Ordering System)
- [CVE-2025-11612](https://cve.now/CVE-2025-11612.md): code-projects Simple Food Ordering System addproduct.php sql injection (CVSS 5.3, code-projects Simple Food Ordering System)
- [CVE-2025-11611](https://cve.now/CVE-2025-11611.md): SourceCodester Simple Inventory System user.php sql injection (CVSS 5.3, SourceCodester Simple Inventory System)
- [CVE-2025-11610](https://cve.now/CVE-2025-11610.md): SourceCodester Simple Inventory System brand.php sql injection (CVSS 5.3, SourceCodester Simple Inventory System)
- [CVE-2025-11609](https://cve.now/CVE-2025-11609.md): code-projects Hospital Management System express-session hard-coded key (CVSS 6.3, code-projects Hospital Management System)
- [CVE-2025-11608](https://cve.now/CVE-2025-11608.md): code-projects E-Banking System POST Parameter register.php sql injection (CVSS 6.9, code-projects E-Banking System)
- [CVE-2025-11607](https://cve.now/CVE-2025-11607.md): harry0703 MoneyPrinterTurbo API Endpoint music.py upload\_music path traversal (CVSS 5.3, harry0703 MoneyPrinterTurbo)
- [CVE-2025-11606](https://cve.now/CVE-2025-11606.md): iPynch Social Network Website Search sql injection (CVSS 5.3, iPynch Social Network Website)
- [CVE-2025-11605](https://cve.now/CVE-2025-11605.md): code-projects Client Details System update-profile.php sql injection (CVSS 5.3, code-projects Client Details System)
- [CVE-2025-11604](https://cve.now/CVE-2025-11604.md): projectworlds Online Ordering Food System all-orders.php sql injection (CVSS 6.9, projectworlds Online Ordering Food System)
- [CVE-2025-11603](https://cve.now/CVE-2025-11603.md): code-projects Simple Food Ordering System editproduct.php sql injection (CVSS 5.3, code-projects Simple Food Ordering System)
- [CVE-2025-11601](https://cve.now/CVE-2025-11601.md): SourceCodester Online Student Result System login.php sql injection (CVSS 6.9, SourceCodester Online Student Result System)
- [CVE-2025-11600](https://cve.now/CVE-2025-11600.md): code-projects Simple Food Ordering System editcategory.php sql injection (CVSS 5.3, code-projects Simple Food Ordering System)
- [CVE-2025-11599](https://cve.now/CVE-2025-11599.md): Campcodes Online Apartment Visitor Management System forgot-password.php sql injection (CVSS 6.9, Campcodes Online Apartment Visitor Management System)
- [CVE-2025-11597](https://cve.now/CVE-2025-11597.md): code-projects E-Commerce Website product\_add\_qty.php sql injection (CVSS 5.3, code-projects E-Commerce Website)
- [CVE-2025-11596](https://cve.now/CVE-2025-11596.md): code-projects E-Commerce Website delete\_order\_details.php sql injection (CVSS 6.9, code-projects E-Commerce Website)
- [CVE-2025-11595](https://cve.now/CVE-2025-11595.md): Campcodes Online Apartment Visitor Management System admin-profile.php sql injection (CVSS 5.1, Campcodes Online Apartment Visitor Management System)
- [CVE-2025-10376](https://cve.now/CVE-2025-10376.md): Course Redirects for Learndash Plugin \<= 0.4 - Cross-Site Request Forgery (CVSS 4.3, ercbs Course Redirects for Learndash Plugin)
- [CVE-2025-10129](https://cve.now/CVE-2025-10129.md): WordPress Live Webcam Widget & Shortcode \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, miksco WordPress Live Webcam Widget & Shortcode)
- [CVE-2025-10375](https://cve.now/CVE-2025-10375.md): Web Accessibility By accessiBe \<= 2.10 - Cross-Site Request Forgery (CVSS 4.3, accessibewp Web Accessibility by accessiBe)
- [CVE-2025-9947](https://cve.now/CVE-2025-9947.md): Custom 404 Pro \<= 3.12.0 - Authenticated (Administrator+) SQL Injection via \`path\` Parameter (CVSS 4.9, kunalnagar Custom 404 Pro)
- [CVE-2025-8606](https://cve.now/CVE-2025-8606.md): GSheetConnector For Gravity Forms \<= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation (CVSS 2.4, westerndeal GSheetConnector for Gravity Forms – Send Gravit…)
- [CVE-2025-10175](https://cve.now/CVE-2025-10175.md): WP Links Page \<= 4.9.6 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, rico-macchi WP Links Page)
- [CVE-2025-8593](https://cve.now/CVE-2025-8593.md): GSheetConnector For Gravity Forms \<= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation (CVSS 8.8, westerndeal GSheetConnector for Gravity Forms – Send Gravit…)
- [CVE-2025-8484](https://cve.now/CVE-2025-8484.md): Code Quality Control Tool \<= 2.1 - Unauthenticated Information Exposure via Log Files (CVSS 5.3, nickclarkweb Code Quality Control Tool)
- [CVE-2025-9950](https://cve.now/CVE-2025-9950.md): Error Log Viewer by BestWebSoft \<= 1.1.6 - Authenticated (Administrator+) Arbitrary File Read (CVSS 4.9, Error Log Viewer by BestWebSoft)
- [CVE-2025-8682](https://cve.now/CVE-2025-8682.md): Newsup \<= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation (CVSS 4.3, themeansar Newsup)
- [CVE-2025-9626](https://cve.now/CVE-2025-9626.md): Page Blocks \<= 1.1.0 - Cross-Site Request Forgery (CVSS 4.3, softwud Page Blocks)
- [CVE-2025-10190](https://cve.now/CVE-2025-10190.md): WP Easy Toggles \<= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, husainahmedqureshi WP Easy Toggles)
- [CVE-2025-9975](https://cve.now/CVE-2025-9975.md): WP Scraper \<= 5.8.1 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 6.8, rico-macchi WP Scraper)
- [CVE-2025-6439](https://cve.now/CVE-2025-6439.md): WooCommerce Designer Pro \<= 1.9.26 - Unauthenticated Arbitrary File Deletion (CVSS 9.8, JMA Plugins WooCommerce Designer Pro)
- [CVE-2025-7652](https://cve.now/CVE-2025-7652.md): Easy Plugin Stats \<= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ndiego Easy Plugin Stats)
- [CVE-2025-10167](https://cve.now/CVE-2025-10167.md): Stock History & Reports Manager for WooCommerce \<= 2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpcodefactory Stock History & Reports Manager for WooCommer…)
- [CVE-2025-9621](https://cve.now/CVE-2025-9621.md): WidgetPack Comment System \<= 1.6.1 - Cross-Site Request Forgery (CVSS 4.3, WidgetPack Comment System)
- [CVE-2025-58293](https://cve.now/CVE-2025-58293.md): Vulnerability of improper exception handling in the print module. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2025-58289](https://cve.now/CVE-2025-58289.md): Vulnerability of improper exception handling in the print module. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2025-58301](https://cve.now/CVE-2025-58301.md): Buffer overflow vulnerability in the device management module. (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-58300](https://cve.now/CVE-2025-58300.md): Buffer overflow vulnerability in the device management module. (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-58299](https://cve.now/CVE-2025-58299.md): Use After Free (UAF) vulnerability in the storage management module. (CVSS 8.4, Huawei HarmonyOS)
- [CVE-2025-58298](https://cve.now/CVE-2025-58298.md): Data processing error vulnerability in the package management module. (CVSS 7.3, Huawei HarmonyOS)
- [CVE-2025-11594](https://cve.now/CVE-2025-11594.md): ywxbear PHP-Bookstore-Website-Example Quantity index.php improper validation of specified quantity in input (CVSS 6.9, ywxbear PHP-Bookstore-Website-Example · ywxbear PHP Basic B…)
- [CVE-2025-58297](https://cve.now/CVE-2025-58297.md): Buffer overflow vulnerability in the sensor service. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2025-58295](https://cve.now/CVE-2025-58295.md): Buffer overflow vulnerability in the development framework module. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2025-58292](https://cve.now/CVE-2025-58292.md): Denial of service (DoS) vulnerability in the office service. (CVSS 3.3, Huawei HarmonyOS)
- [CVE-2025-58291](https://cve.now/CVE-2025-58291.md): Denial of service (DoS) vulnerability in the office service. (CVSS 3.3, Huawei HarmonyOS)
- [CVE-2025-58290](https://cve.now/CVE-2025-58290.md): Denial of service (DoS) vulnerability in the office service. (CVSS 3.3, Huawei HarmonyOS)
- [CVE-2025-58288](https://cve.now/CVE-2025-58288.md): Denial of service (DoS) vulnerability in the office service. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2025-58287](https://cve.now/CVE-2025-58287.md): Use After Free (UAF) vulnerability in the office service. (CVSS 7.8, Huawei HarmonyOS)
- [CVE-2025-58286](https://cve.now/CVE-2025-58286.md): Denial of service (DoS) vulnerability in the office service. (CVSS 3.3, Huawei HarmonyOS)
- [CVE-2025-11167](https://cve.now/CVE-2025-11167.md): CM Registration – Tailored tool for seamless login and invitation-based registrations \<= 2.5.6 - Open Redirect (CVSS 4.7, creativemindssolutions CM Registration – Tailored tool for…)
- [CVE-2025-11518](https://cve.now/CVE-2025-11518.md): WPC Smart Wishlist for WooCommerce \<= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation (CVSS 5.3, wpclever WPC Smart Wishlist for WooCommerce)
- [CVE-2025-11254](https://cve.now/CVE-2025-11254.md): Contest Gallery – Upload, Vote & Sell with PayPal and Stripe \<= 27.0.3 - Unauthenticated CSV Injection (CVSS 4.3, contest-gallery Contest Gallery – Upload & Vote Photos, Med…)
- [CVE-2025-6553](https://cve.now/CVE-2025-6553.md): Ovatheme Events Manager \<= 1.8.5 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Ovatheme Events Manager)
- [CVE-2025-10185](https://cve.now/CVE-2025-10185.md): NEX-Forms – Ultimate Forms Plugin for WordPress \<= 9.1.6 - Authenticated (Admin+) SQL Injection (CVSS 4.9, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2025-10048](https://cve.now/CVE-2025-10048.md): My Auctions Allegro Plugin \<= 3.6.31 - Authenticated (Admin+) SQL Injection (CVSS 4.9, wphocus My auctions allegro)
- [CVE-2025-9196](https://cve.now/CVE-2025-9196.md): Trinity Audio \<= 5.21.0 - Unauthenticated Information Exposure (CVSS 5.3, sergiotrinity Trinity Audio – Text to Speech AI audio playe…)
- [CVE-2025-11197](https://cve.now/CVE-2025-11197.md): Draft List \<= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, dartiss Draft List)
- [CVE-2025-11533](https://cve.now/CVE-2025-11533.md): WP Freeio \<= 1.2.21 - Unauthenticated Privilege Escalation (CVSS 9.8, ApusTheme WP Freeio)
- [CVE-2025-9496](https://cve.now/CVE-2025-9496.md): Enable Media Replace \<= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file\_modified Shortcode (CVSS 6.4, shortpixel Enable Media Replace)
- [CVE-2025-11593](https://cve.now/CVE-2025-11593.md): CodeAstro Gym Management System delete-equipment.php sql injection (CVSS 5.3, CodeAstro Gym Management System)
- [CVE-2025-11592](https://cve.now/CVE-2025-11592.md): CodeAstro Gym Management System edit-equipmentform.php sql injection (CVSS 5.3, CodeAstro Gym Management System)
- [CVE-2025-11591](https://cve.now/CVE-2025-11591.md): CodeAstro Gym Management System delete-member.php sql injection (CVSS 5.3, CodeAstro Gym Management System)
- [CVE-2025-58285](https://cve.now/CVE-2025-58285.md): Permission control vulnerability in the media module. (CVSS 5.3, Huawei HarmonyOS)
- [CVE-2025-58284](https://cve.now/CVE-2025-58284.md): Permission control vulnerability in the network module. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2025-58283](https://cve.now/CVE-2025-58283.md): Permission control vulnerability in the Wi-Fi module. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2025-58282](https://cve.now/CVE-2025-58282.md): Permission control vulnerability in the camera module. (CVSS 2.8, Huawei HarmonyOS)
- [CVE-2025-58278](https://cve.now/CVE-2025-58278.md): Identity authentication bypass vulnerability in the Gallery app. (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-58277](https://cve.now/CVE-2025-58277.md): Permission verification bypass vulnerability in the Camera app. (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2025-11380](https://cve.now/CVE-2025-11380.md): Everest Backup \<= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure (CVSS 5.9, everestthemes Everest Backup – WordPress Cloud Backup, Migr…)
- [CVE-2025-9560](https://cve.now/CVE-2025-9560.md): Colibri Page Builder \<= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri\_newsletter Shortcode (CVSS 6.4, extendthemes Colibri Page Builder)
- [CVE-2025-54654](https://cve.now/CVE-2025-54654.md): Permission control vulnerability in the Gallery module. (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-11590](https://cve.now/CVE-2025-11590.md): CodeAstro Gym Management System equipment-entry.php sql injection (CVSS 5.3, CodeAstro Gym Management System)
- [CVE-2025-31718](https://cve.now/CVE-2025-31718.md): In modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T606/T612/T616/T750/T765…)
- [CVE-2025-31717](https://cve.now/CVE-2025-31717.md): In modem, there is a possible system crash due to improper input validation. (CVSS 7.5, Unisoc (Shanghai) Technologies Co. T750/T765/T760/T770/T820…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.