CVEs published October 13, 2025
90 CVEs were published on October 13, 2025: 5 critical, 25 high. 1 is now in CISA KEV.
- Published
- 90
- Critical
- 5
- High
- 25
- Medium
- 55
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 37
Most affected products
- Ivanti Endpoint Manager
- 13
- LabRedesCefetRJ WeGIA
- 7
- Liferay Portal · Liferay DXP +1
- 6
- ProjectsAndPrograms School Management System
- 6
- ASUS Armoury Crate
- 3
- mastodon
- 3
- Campcodes Online Beauty Parlor Management System
- 2
- code-projects Automated Voting System
- 2
- Dassault Systèmes 3DSwymer
- 2
- EBM Technologies Uniweb/SoliPACS WebServer
- 2
Critical 5
- CVE-2025-62360WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`LabRedesCefetRJ WeGIA
- CVE-2025-37729Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template EngineElastic Cloud Enterprise
- CVE-2025-6919SQLi in Cats Informatics' AykomeCats Information Technology Software Development Technologi…
- CVE-2025-9976OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xDassault Systèmes Station Launcher App in 3DEXPERIENCE plat…
- CVE-2025-9265API Authentication Bypass via Header Spoofing vulnerability in Kiloview NDI N30 ProductsKiloview NDI
High 25
- CVE-2025-62363yt-grabber-tui allows arbitrary code execution via configurable yt-dlp pathzheny-creator YtGrabber-TUI
- CVE-2025-62179WeGIA SQL Injection via 'cpf' param at endpoint `/html/funcionario/cadastro_funcionario_pessoa_existente.php`LabRedesCefetRJ WeGIA
- CVE-2025-62177WeGIA vulnerable to SQL Injection via 'id_funcionario' param at endpoint `/html/funcionario/dependente_listar.php`LabRedesCefetRJ WeGIA
- CVE-2025-9713Path traversal in Ivanti Endpoint Manager before version 2024 SU4 allows a remote unauthenticated attacker to achieve remote code execution.Ivanti Endpoint Manager
- CVE-2025-11622Insecure deserialization in Ivanti Endpoint Manager before version 2024 SU4 allows a local authenticated attacker to escalate their privilegIvanti Endpoint Manager
- CVE-2025-61688Omni leaks information via the APIsiderolabs omni · github.com/siderolabs/omni
- CVE-2025-62170rAthena map-server use-after-free vulnerability in RODEXrathena
- CVE-2025-11695Configuration may unexpectedly disable certificate validationMongoDB Rust Driver · mongodb
- CVE-2025-7707World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_indexrun-llama/llama_index · llama-index
- CVE-2025-39965xfrm: xfrm_alloc_spi shouldn't use 0 as SPILinux
- CVE-2025-39964crypto: af_alg - Disallow concurrent writes in af_alg_sendmsgLinux
- CVE-2025-9902IDOR in Akınsoft QRMenuAKIN Software Computer Import Export Industry and Trade Co.…
- CVE-2025-9968A link following vulnerability exists in the UnifyScanner component of Armoury Crate.ASUS Armoury Crate
- CVE-2025-11675Ragic｜Enterprise Cloud Database - Arbitrary File UploadRagic Enterprise Cloud Database
- CVE-2025-10558Stored Cross-site Scripting (XSS) vulnerability affecting 3DSearch in 3DSwymer on Release 3DEXPERIENCE R2025xDassault Systèmes 3DSwymer
- CVE-2025-10557Stored Cross-site Scripting (XSS) vulnerability affecting Issue Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025xDassault Systèmes ENOVIA Collaborative Industry Innovator
- CVE-2025-10556Stored Cross-site Scripting (XSS) vulnerability affecting Specification Management in ENOVIA Specification Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025xDassault Systèmes ENOVIA Specification Manager
- CVE-2025-10552Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2025xDassault Systèmes 3DSwymer
- CVE-2025-11673PiExtract ｜SOOP-CLM - Hidden FunctionalityPiExtract SOOP-CLM
- CVE-2025-11666Tenda RP3 Pro Firmware Update force_upgrade.sh hard-coded passwordTenda RP3 Pro
- CVE-2025-8915Hardcoded TLS private key in Kiloview N30 firmwareKiloview N30
- CVE-2025-0636Arbitrary Code Execution vulnerability in Ericsson RAN Compute and Site ControllerEricsson Site Controller · Ericsson RAN Compute
- CVE-2025-36087IBM Security Verify Access hard coded credentialsIBM Security Verify Access · IBM Verify Identity Access Con…
- CVE-2025-11653UTT HiPER 2620G fNTP strcpy buffer overflowUTT HiPER
- CVE-2025-11652UTT 进取 518G formTaskEdit_ap buffer overflowUTT 进取
Medium, low and unrated 60
- CVE-2025-62365LibreNMS vulnerable to Reflected-XSS in `report_this` functionlibrenms · librenms/librenms
- CVE-2025-62362Name and e-mail of employee that has done a publication is discoverable in gpp-burgerportaalGPP-Woo GPP-burgerportaal
- CVE-2025-62361WeGIA Open Redirect Vulnerability in `control.php` endpoint `nextPage` parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle)LabRedesCefetRJ WeGIA
- CVE-2025-62251Liferay Portal 7.3.0 through 7.4.3.119, and Liferay DXP 2023.Q3.1 through 2023.Q3.8, 2023.Q4.0 through 2023.Q4.5, 7.4 GA through update 92 aLiferay Portal · Liferay DXP +1
- CVE-2025-62359WeGIA Cross-Site Scripting (XSS) Reflected endpoint id_petLabRedesCefetRJ WeGIA
- CVE-2025-62358WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameterLabRedesCefetRJ WeGIA
- CVE-2025-62384SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62386SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62383SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62391SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62178WeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' parameter 'idatendido'LabRedesCefetRJ WeGIA
- CVE-2025-62385SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62387SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62388SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62389SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62390SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62392SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-11623SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the dataIvanti Endpoint Manager
- CVE-2025-62176Mastadon streaming server allows OAuth clients without the `read` scope to subscribe to public channelsmastodon
- CVE-2025-62175Mastodon streaming API fails to disconnect disabled and suspended usersmastodon
- CVE-2025-62174Mastodon allows continued access after password reset via CLImastodon
- CVE-2025-59836Omni is Vulnerable to DoS via Empty Create/Update Resource Requestssiderolabs omni · github.com/siderolabs/omni
- CVE-2025-62252Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and LiferayLiferay Portal · Liferay DXP +1
- CVE-2025-62364text-generation-webui allows arbitrary file read via symbolic link uploadoobabooga text-generation-webui
- CVE-2025-62246Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and LiLiferay Portal · Liferay DXP +1
- CVE-2025-58084Mattermost Desktop App crashes when clicking on malformed external URLMattermost
- CVE-2025-62241Insecure Direct Object Reference (IDOR) vulnerability with shipment addresses in Liferay DXP 2023.Q4.1 through 2023.Q4.5 allows remote autheLiferay DXP · com.liferay.commerce:com.liferay.commerce.ord…
- CVE-2025-62242Insecure Direct Object Reference (IDOR) vulnerability with account addresses in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 20Liferay Portal · Liferay DXP +1
- CVE-2025-61775Vickey's unexpired email confirmation link can be reused to send repeated confirmation emailsWhimsies-YAT Vickey
- CVE-2025-62243Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.4.1 through 7.4.3.112, and Liferay DXP 2023.Q4.0 tLiferay Portal · Liferay DXP +1
- CVE-2025-62244Insecure direct object reference (IDOR) vulnerability in Publications in Liferay Portal 7.3.1 through 7.4.3.111, and Liferay DXP 2023.Q4.0 tLiferay Portal · Liferay DXP +1
- CVE-2025-43991SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic LiDell SupportAssist for Home PCs · Dell SupportAssist for Bu…
- CVE-2025-10720WP Private Content Plus <= 3.6.2 - Password Protection BypassWP Private Content Plus
- CVE-2025-9337A null pointer dereference has been identified in the AsIO3.sys driver.ASUS Armoury Crate
- CVE-2025-9336A stack buffer overflow has been identified in the AsIO3.sys driver.ASUS Armoury Crate
- CVE-2025-11184Cross-Site Scripting Vulnerability in QWC2 Registration GUIqwc-services qwc-registration-gui
- CVE-2025-11183Cross-Site Scripting Vulnerability in QWC2QGIS QWC2 · qwc2
- CVE-2025-11668code-projects Automated Voting System update_user.php sql injectioncode-projects Automated Voting System
- CVE-2025-11674PiExtract｜SOOP-CLM - Server-Side Request ForgeryPiExtract SOOP-CLM
- CVE-2025-11672EBM Technologies｜Uniweb/SoliPACS WebServer - Missing AuthenticationEBM Technologies Uniweb/SoliPACS WebServer
- CVE-2025-11667code-projects Automated Voting System add_candidate_modal.php. sql injectioncode-projects Automated Voting System
- CVE-2025-11671EBM Technologies｜Uniweb/SoliPACS WebServer - Missing AuthenticationEBM Technologies Uniweb/SoliPACS WebServer
- CVE-2025-11665D-Link DAP-2695 Firmware Update rgbin fwupdater_main os command injectionD-Link DAP-2695
- CVE-2025-27258Ericsson Network Manager: escalation of privilege vulnerabilityEricsson Network Manager
- CVE-2025-27259Ericsson Network Manager: improper neutralization of user controlled inputEricsson Network Manager
- CVE-2025-11664Campcodes Online Beauty Parlor Management System search-appointment.php sql injectionCampcodes Online Beauty Parlor Management System
- CVE-2025-9698The Plus Addons for Elementor < 6.3.16 - Author+ Stored XSSThe Plus Addons for Elementor
- CVE-2025-11663Campcodes Online Beauty Parlor Management System manage-services.php sql injectionCampcodes Online Beauty Parlor Management System
- CVE-2025-11662SourceCodester Best Salon Management System booking.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-31995HCL Unica MaxAI Workbench is vulnerable to improper input validationHCL Software MaxAI Workbench
- CVE-2025-11661ProjectsAndPrograms School Management System missing authenticationProjectsAndPrograms School Management System
- CVE-2025-11660ProjectsAndPrograms School Management System uploadSllyabus.php unrestricted uploadProjectsAndPrograms School Management System
- CVE-2025-31994HCL Unica Campaign is vulnerable to Reflected Cross-Site Scripting (XSS)HCL Software Unica Campaign
- CVE-2025-31996Unprotected files are impacting HCL Unica PlatformHCL Software Unica Platform
- CVE-2025-11659ProjectsAndPrograms School Management System uploadNotes.php unrestricted uploadProjectsAndPrograms School Management System
- CVE-2025-11658ProjectsAndPrograms School Management System changeSllyabus.php unrestricted uploadProjectsAndPrograms School Management System
- CVE-2025-11657ProjectsAndPrograms School Management System createNotice.php unrestricted uploadProjectsAndPrograms School Management System
- CVE-2025-11656ProjectsAndPrograms School Management System editNotes.php unrestricted uploadProjectsAndPrograms School Management System
- CVE-2025-11655Total.js Flow SVG File unrestricted uploadTotal.js Flow
- CVE-2025-11654yousaf530 Inferno Online Clothing Store log.php sql injectionyousaf530 Inferno Online Clothing Store