# CVEs published 2025-10-27

315 CVEs were published on October 27, 2025: 10 critical, 73 high. Days are UTC.

- [CVE-2025-33133](https://cve.now/CVE-2025-33133.md): Fixes to common vulnerabilities found in IBM Db2 High Performance Unload (CVSS 6.5, IBM DB2 High Performance Unload)
- [CVE-2025-33132](https://cve.now/CVE-2025-33132.md): Fixes to common vulnerabilities found in IBM Db2 High Performance Unload (CVSS 6.5, IBM DB2 High Performance Unload)
- [CVE-2025-33131](https://cve.now/CVE-2025-33131.md): Fixes to common vulnerabilities found in IBM Db2 High Performance Unload (CVSS 6.5, IBM DB2 High Performance Unload)
- [CVE-2025-33126](https://cve.now/CVE-2025-33126.md): Fixes to common vulnerabilities found in IBM Db2 High Performance Unload (CVSS 6.5, IBM DB2 High Performance Unload)
- [CVE-2025-12335](https://cve.now/CVE-2025-12335.md): code-projects E-Commerce Website supplier\_update.php cross site scripting (CVSS 5.3, code-projects E-Commerce Website)
- [CVE-2025-12332](https://cve.now/CVE-2025-12332.md): SourceCodester Student Grades Management System admin.php delete\_user cross site scripting (CVSS 4.8, SourceCodester Student Grades Management System)
- [CVE-2025-43024](https://cve.now/CVE-2025-43024.md): HP ThinPro 8.1 SP8 Security Updates (CVSS 5.1, HP ThinPro)
- [CVE-2025-62258](https://cve.now/CVE-2025-62258.md): CSRF vulnerability in Headless API in Liferay Portal 7.4.0 through 7.4.3.107, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through up (CVSS 7.0, Liferay Portal · Liferay DXP +1)
- [CVE-2025-12334](https://cve.now/CVE-2025-12334.md): code-projects E-Commerce Website product\_add.php cross site scripting (CVSS 5.3, code-projects E-Commerce Website)
- [CVE-2025-12333](https://cve.now/CVE-2025-12333.md): code-projects E-Commerce Website supplier\_add.php cross site scripting (CVSS 5.3, code-projects E-Commerce Website)
- [CVE-2025-62259](https://cve.now/CVE-2025-62259.md): Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 9 (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-12331](https://cve.now/CVE-2025-12331.md): Willow CMS add unrestricted upload (CVSS 5.1, Willow CMS)
- [CVE-2025-12330](https://cve.now/CVE-2025-12330.md): Willow CMS Add Post add cross site scripting (CVSS 4.8, Willow CMS)
- [CVE-2025-62260](https://cve.now/CVE-2025-62260.md): Liferay Portal 7.4.0 through 7.4.3.99, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and (CVSS 7.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-12329](https://cve.now/CVE-2025-12329.md): shawon100 RUET OJ details.php sql injection (CVSS 5.3, shawon100 RUET OJ)
- [CVE-2025-12328](https://cve.now/CVE-2025-12328.md): shawon100 RUET OJ contestproblem.php sql injection (CVSS 5.3, shawon100 RUET OJ)
- [CVE-2025-62793](https://cve.now/CVE-2025-62793.md): eLabFTW HTML / CSS Injection via Malicious SVG Upload Leads to Credential Theft / Clickjacking (CVSS 6.8, elabftw)
- [CVE-2025-62781](https://cve.now/CVE-2025-62781.md): PILOS is missing session regeneration after password change (CVSS 5.0, THM-Health PILOS)
- [CVE-2025-62779](https://cve.now/CVE-2025-62779.md): Frappe Learning users were able to add HTML through input fields in the Job Form (CVSS 1.2, frappe lms)
- [CVE-2025-62778](https://cve.now/CVE-2025-62778.md): Frappe Learning allowed students to access the Quiz Form via direct URL (CVSS 1.3, frappe lms)
- [CVE-2025-62261](https://cve.now/CVE-2025-62261.md): Liferay Portal 7.4.0 through 7.4.3.99, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 (CVSS 6.9, Liferay Portal · Liferay DXP +2)
- [CVE-2025-12327](https://cve.now/CVE-2025-12327.md): shawon100 RUET OJ description.php sql injection (CVSS 5.3, shawon100 RUET OJ)
- [CVE-2025-12326](https://cve.now/CVE-2025-12326.md): shawon100 RUET OJ POST Request process.php sql injection (CVSS 6.9, shawon100 RUET OJ)
- [CVE-2025-62784](https://cve.now/CVE-2025-62784.md): InventoryGui allows item duplication in GUIs which use GuiStorageElement (CVSS 5.3, Phoenix616 InventoryGui · de.themoep:inventorygui)
- [CVE-2025-62783](https://cve.now/CVE-2025-62783.md): InventoryGui affected by item duplication in GUIs which use GuiStorageElement (CVSS 5.0, Phoenix616 InventoryGui · de.themoep:inventorygui)
- [CVE-2025-62782](https://cve.now/CVE-2025-62782.md): InventoryGUI vulnerable to item duplication via Bundle items when using GuiStorageElement (CVSS 5.9, Phoenix616 InventoryGui · de.themoep:inventorygui)
- [CVE-2025-62262](https://cve.now/CVE-2025-62262.md): Information exposure through log file vulnerability in LDAP import feature in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported v (CVSS 4.6, Liferay Portal · Liferay DXP +1)
- [CVE-2025-62725](https://cve.now/CVE-2025-62725.md): Docker Compose Vulnerable to Path Traversal via OCI Artifact Layer Annotations (CVSS 8.9, docker compose · github.com/docker/compose/v2 +1)
- [CVE-2025-12325](https://cve.now/CVE-2025-12325.md): SourceCodester Best Salon Management System forgot-password.php sql injection (CVSS 6.9, SourceCodester Best Salon Management System)
- [CVE-2025-12322](https://cve.now/CVE-2025-12322.md): Tenda CH22 NatStaticSetting fromNatStaticSetting buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12316](https://cve.now/CVE-2025-12316.md): code-projects Courier Management System edit-courier.php sql injection (CVSS 6.9, code-projects Courier Management System)
- [CVE-2025-62524](https://cve.now/CVE-2025-62524.md): PILOS Exposes PHP version (CVSS 5.3, THM-Health PILOS)
- [CVE-2025-62523](https://cve.now/CVE-2025-62523.md): PILOS Misconfigured the Access-Control-Allow-Origin Header (CVSS 6.3, THM-Health PILOS)
- [CVE-2025-12315](https://cve.now/CVE-2025-12315.md): code-projects Food Ordering System menu.php sql injection (CVSS 5.1, code-projects Food Ordering System)
- [CVE-2025-12314](https://cve.now/CVE-2025-12314.md): code-projects Food Ordering System deleteitem.php sql injection (CVSS 5.1, code-projects Food Ordering System)
- [CVE-2025-12313](https://cve.now/CVE-2025-12313.md): D-Link DI-7001 MINI msp\_info.htm command injection (CVSS 5.3, D-Link DI-7001 MINI)
- [CVE-2025-62594](https://cve.now/CVE-2025-62594.md): ImageMagick CLAHE : Unsigned underflow and division-by-zero lead to OOB pointer arithmetic and process crash (DoS) (CVSS 4.7, ImageMagick · Magick.NET-Q16-x64 +11)
- [CVE-2025-59151](https://cve.now/CVE-2025-59151.md): Pi-hole Admin Interface vulnerable to HTTP response header injection via CRLF injection (CVSS 8.2, pi-hole web)
- [CVE-2025-62263](https://cve.now/CVE-2025-62263.md): Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.7 through 7.4.3.103, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-58356](https://cve.now/CVE-2025-58356.md): Constellation allows insecure use of LUKS2 persistent storage partitions (CVSS 8.3, edgelesssys constellation · github.com/edgelesssys/const… +1)
- [CVE-2025-12312](https://cve.now/CVE-2025-12312.md): PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting (CVSS 4.8, PHPGurukul Curfew e-Pass Management System)
- [CVE-2025-12311](https://cve.now/CVE-2025-12311.md): PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting (CVSS 4.8, PHPGurukul Curfew e-Pass Management System)
- [CVE-2025-12310](https://cve.now/CVE-2025-12310.md): VirtFusion Email Change \_settings excessive authentication (CVSS 6.9, VirtFusion)
- [CVE-2025-53533](https://cve.now/CVE-2025-53533.md): Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page (CVSS 5.1, pi-hole web)
- [CVE-2025-12309](https://cve.now/CVE-2025-12309.md): code-projects Nero Social Networking Site friendprofile.php sql injection (CVSS 6.9, code-projects Nero Social Networking Site)
- [CVE-2025-12308](https://cve.now/CVE-2025-12308.md): code-projects Nero Social Networking Site deletemessage.php sql injection (CVSS 6.9, code-projects Nero Social Networking Site)
- [CVE-2025-12307](https://cve.now/CVE-2025-12307.md): code-projects Nero Social Networking Site addfriend.php sql injection (CVSS 6.9, code-projects Nero Social Networking Site)
- [CVE-2025-62253](https://cve.now/CVE-2025-62253.md): Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-36138](https://cve.now/CVE-2025-36138.md): IBM QRadar SIEM cross-site scripting (CVSS 6.4, IBM QRadar SIEM)
- [CVE-2025-36170](https://cve.now/CVE-2025-36170.md): IBM QRadar SIEM cross-site scripting (CVSS 6.4, IBM QRadar SIEM)
- [CVE-2025-32785](https://cve.now/CVE-2025-32785.md): Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field) (CVSS 2.0, pi-hole web)
- [CVE-2025-46602](https://cve.now/CVE-2025-46602.md): Dell SupportAssist OS Recovery, versions prior to 5.5.15.0, contain an Insertion of Sensitive Information into Externally-Accessible File or (CVSS 4.4, Dell SupportAssist OS Recovery)
- [CVE-2025-36007](https://cve.now/CVE-2025-36007.md): IBM QRadar SIEM incorrect privilege assignment (CVSS 7.8, IBM QRadar SIEM)
- [CVE-2025-12306](https://cve.now/CVE-2025-12306.md): code-projects Nero Social Networking Site acceptoffres.php sql injection (CVSS 6.9, code-projects Nero Social Networking Site)
- [CVE-2025-12305](https://cve.now/CVE-2025-12305.md): quequnlong shiyi-blog Job SysJobController.java deserialization (CVSS 5.3, quequnlong shiyi-blog)
- [CVE-2025-12304](https://cve.now/CVE-2025-12304.md): dulaiduwang003 TIME-SEA-PLUS Order Status PayController.java alipayIsSucceed improper authorization (CVSS 5.3, dulaiduwang003 TIME-SEA-PLUS)
- [CVE-2025-12365](https://cve.now/CVE-2025-12365.md): Error Messages Wrapped In HTTP Header (CVSS 6.9, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12364](https://cve.now/CVE-2025-12364.md): Weak Password Policy (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12363](https://cve.now/CVE-2025-12363.md): Email Password Disclosure (CVSS 10.0, Azure Access Technology BLU-IC2 · Azure Access Technology B…)
- [CVE-2025-12303](https://cve.now/CVE-2025-12303.md): PHPGurukul Curfew e-Pass Management System admin-profile.php cross site scripting (CVSS 4.8, PHPGurukul Curfew e-Pass Management System)
- [CVE-2025-12302](https://cve.now/CVE-2025-12302.md): code-projects Simple Food Ordering System editproduct.php cross site scripting (CVSS 5.3, code-projects Simple Food Ordering System)
- [CVE-2025-12301](https://cve.now/CVE-2025-12301.md): code-projects Simple Food Ordering System editproduct.php unrestricted upload (CVSS 6.9, code-projects Simple Food Ordering System)
- [CVE-2025-12300](https://cve.now/CVE-2025-12300.md): code-projects Simple Food Ordering System addcategory.php cross site scripting (CVSS 5.3, code-projects Simple Food Ordering System)
- [CVE-2025-61795](https://cve.now/CVE-2025-61795.md): Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS (CVSS 5.3, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2025-55752](https://cve.now/CVE-2025-55752.md): Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled (CVSS 7.5, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2025-55754](https://cve.now/CVE-2025-55754.md): Apache Tomcat: console manipulation via escape sequences in log messages (CVSS 9.6, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2025-12299](https://cve.now/CVE-2025-12299.md): code-projects Simple Food Ordering System addproduct.php cross site scripting (CVSS 5.3, code-projects Simple Food Ordering System)
- [CVE-2025-12298](https://cve.now/CVE-2025-12298.md): code-projects Simple Food Ordering System editcategory.php cross site scripting (CVSS 5.3, code-projects Simple Food Ordering System)
- [CVE-2025-12297](https://cve.now/CVE-2025-12297.md): atjiu pybbs UserApiController.java information disclosure (CVSS 5.3, atjiu pybbs)
- [CVE-2025-12296](https://cve.now/CVE-2025-12296.md): D-Link DAP-2695 Firmware Update sub\_4174B0 os command injection (CVSS 5.1, D-Link DAP-2695)
- [CVE-2025-12295](https://cve.now/CVE-2025-12295.md): D-Link DAP-2695 Firmware Update sub\_40C6B8 signature verification (CVSS 7.5, D-Link DAP-2695)
- [CVE-2025-12294](https://cve.now/CVE-2025-12294.md): SourceCodester Point of Sales delete\_category.php sql injection (CVSS 5.1, SourceCodester Point of Sales)
- [CVE-2025-12293](https://cve.now/CVE-2025-12293.md): SourceCodester Point of Sales category.php sql injection (CVSS 6.9, SourceCodester Point of Sales)
- [CVE-2025-12292](https://cve.now/CVE-2025-12292.md): SourceCodester Point of Sales index.php sql injection (CVSS 6.9, SourceCodester Point of Sales)
- [CVE-2025-12291](https://cve.now/CVE-2025-12291.md): ashymuzuro Full-Ecommece-Website/Muzuro Ecommerce System Add Product index.php unrestricted upload (CVSS 5.1, ashymuzuro Full-Ecommece-Website · ashymuzuro Muzuro Ecomme…)
- [CVE-2025-34133](https://cve.now/CVE-2025-34133.md): Wimi Teamwork \< v7.38.17 CSRF (CVSS 7.0, Cloud Solutions SAS Wimi Teamwork)
- [CVE-2025-10023](https://cve.now/CVE-2025-10023.md): A user with elevated privileges can inject XSS in the Services Meta-services configuration page (CVSS 6.2, Centreon Infra Monitoring)
- [CVE-2025-12351](https://cve.now/CVE-2025-12351.md): Inadequate access control measure allows unauthorized users to access restricted administrative functions (CVSS 6.8, Honeywell S35 3M/5M/8M/Pinhole/Kit Camera · Honeywell S3… +1)
- [CVE-2025-12290](https://cve.now/CVE-2025-12290.md): Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting (CVSS 5.3, Sui Shang Information Technology Suishang Enterprise-Level…)
- [CVE-2025-12289](https://cve.now/CVE-2025-12289.md): Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting (CVSS 5.3, Sui Shang Information Technology Suishang Enterprise-Level…)
- [CVE-2025-36121](https://cve.now/CVE-2025-36121.md): HTML Injection Vulnerability in a Specific URL Endpoint of the IBM OpenPages Application (CVSS 5.4, IBM OpenPages)
- [CVE-2025-26862](https://cve.now/CVE-2025-26862.md): PingFederate unexpected browser flow initiation in redirectless mode (CVSS 0.0, Ping Identity PingFederate)
- [CVE-2025-34292](https://cve.now/CVE-2025-34292.md): BeWelcome/Rox PHP Object Injection RCE (CVSS 9.4, BeWelcome Rox)
- [CVE-2025-12288](https://cve.now/CVE-2025-12288.md): Bdtask Pharmacy Management System User Profile edit\_user authorization (CVSS 5.3, Bdtask Pharmacy Management System)
- [CVE-2025-12287](https://cve.now/CVE-2025-12287.md): Bdtask Wholesale Inventory Control and Inventory Management System edit\_profile sql injection (CVSS 5.1, Bdtask Wholesale Inventory Control and Inventory Management…)
- [CVE-2025-12286](https://cve.now/CVE-2025-12286.md): VeePN AVService avservice.exe unquoted search path (CVSS 7.3, VeePN)
- [CVE-2025-12283](https://cve.now/CVE-2025-12283.md): code-projects Client Details System authorization (CVSS 5.3, code-projects Client Details System)
- [CVE-2025-9164](https://cve.now/CVE-2025-9164.md): Multiple DLL Search Order Hijacking Vulnerabilities in Docker Desktop Installer for Windows (CVSS 8.8, Docker Desktop)
- [CVE-2025-50055](https://cve.now/CVE-2025-50055.md): Cross-site scripting (XSS) vulnerability in the SAML Authentication module in OpenVPN Access Server version 2.14.0 through 2.14.3 allows con (CVSS 6.4, OpenVPN Access Server)
- [CVE-2025-12282](https://cve.now/CVE-2025-12282.md): code-projects Client Details System manage-users.php cross site scripting (CVSS 4.8, code-projects Client Details System)
- [CVE-2025-12281](https://cve.now/CVE-2025-12281.md): code-projects Client Details System clientview.php cross site scripting (CVSS 4.8, code-projects Client Details System)
- [CVE-2025-12280](https://cve.now/CVE-2025-12280.md): code-projects Client Details System update-clients.php cross site scripting (CVSS 4.8, code-projects Client Details System)
- [CVE-2025-12279](https://cve.now/CVE-2025-12279.md): code-projects Client Details System welcome.php cross site scripting (CVSS 4.8, code-projects Client Details System)
- [CVE-2025-12277](https://cve.now/CVE-2025-12277.md): Abdullah-Hasan-Sajjad Online-School studentLogin.php sql injection (CVSS 6.9, Abdullah-Hasan-Sajjad Online-School)
- [CVE-2025-12276](https://cve.now/CVE-2025-12276.md): LearnHouse Image information disclosure (CVSS 5.3, LearnHouse)
- [CVE-2025-11248](https://cve.now/CVE-2025-11248.md): Sensitive Information Logged (CVSS 3.2, Zohocorp ManageEngine Endpoint Central)
- [CVE-2025-41384](https://cve.now/CVE-2025-41384.md): Reflected Cross-Site Scripting (XSS) in SuiteCRM (CVSS 5.1, SuiteCRM)
- [CVE-2025-41068](https://cve.now/CVE-2025-41068.md): Reachable Assertion vulnerability in Open5GS (CVSS 8.7, NewPlane Open5GS)
- [CVE-2025-41067](https://cve.now/CVE-2025-41067.md): Reachable Assertion vulnerability in Open5GS (CVSS 8.7, NewPlane Open5GS)
- [CVE-2025-12274](https://cve.now/CVE-2025-12274.md): Tenda CH22 P2pListFilter fromP2pListFilter buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12273](https://cve.now/CVE-2025-12273.md): Tenda CH22 webExcptypemanFilter fromwebExcptypemanFilter buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12272](https://cve.now/CVE-2025-12272.md): Tenda CH22 addressNat fromAddressNat buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12271](https://cve.now/CVE-2025-12271.md): Tenda CH22 RouteStatic fromRouteStatic buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12270](https://cve.now/CVE-2025-12270.md): LearnHouse Student Assignment Submission sub\_file resource injection (CVSS 5.3, LearnHouse)
- [CVE-2025-41009](https://cve.now/CVE-2025-41009.md): SQL injection on the virtual campus platform of Diseño de Recursos Educativos (CVSS 9.3, Disenno de Recursos Educativos S.L virtual campus platform)
- [CVE-2025-12269](https://cve.now/CVE-2025-12269.md): LearnHouse Account Setting previews cross site scripting (CVSS 5.1, LearnHouse)
- [CVE-2025-12268](https://cve.now/CVE-2025-12268.md): LearnHouse Course Thumbnail courses unrestricted upload (CVSS 5.3, LearnHouse)
- [CVE-2025-11955](https://cve.now/CVE-2025-11955.md): Incorrect validation of OCSP certificates in TheGreenBow VPN Client Windows Enterprise (CVSS 8.2, TheGreenBow VPN Client Windows Enterprise)
- [CVE-2025-12267](https://cve.now/CVE-2025-12267.md): abhicodebox ModernShop search cross site scripting (CVSS 5.3, abhicodebox ModernShop)
- [CVE-2025-12266](https://cve.now/CVE-2025-12266.md): Zytec Dalian Zhuoyun Technology Central Authentication Service widget \_empty code injection (CVSS 5.3, Zytec Dalian Zhuoyun Technology Central Authentication Serv…)
- [CVE-2025-12265](https://cve.now/CVE-2025-12265.md): Tenda CH22 VirtualSer fromVirtualSer buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12264](https://cve.now/CVE-2025-12264.md): Wisencode Create Support Ticket create cross site scripting (CVSS 5.1, Wisencode)
- [CVE-2025-12263](https://cve.now/CVE-2025-12263.md): code-projects Online Event Judging System edit\_judge.php sql injection (CVSS 5.3, code-projects Online Event Judging System)
- [CVE-2025-12262](https://cve.now/CVE-2025-12262.md): code-projects Online Event Judging System edit\_criteria.php sql injection (CVSS 5.3, code-projects Online Event Judging System)
- [CVE-2025-59463](https://cve.now/CVE-2025-59463.md): Denial-of-service (DoS) via chunk size mismatch (CVSS 4.3, SICK AG TLOC100-100 all Firmware versions)
- [CVE-2025-59462](https://cve.now/CVE-2025-59462.md): Denial-of-service (DoS) via delayed or missing client response (CVSS 6.5, SICK AG TLOC100-100 all Firmware versions)
- [CVE-2025-59461](https://cve.now/CVE-2025-59461.md): API does not require authentication (CVSS 7.6, SICK AG TLOC100-100 all Firmware versions)
- [CVE-2025-59460](https://cve.now/CVE-2025-59460.md): Unsecure access configuration (CVSS 7.5, SICK AG TLOC100-100 with Firmware \<7.1.1 · SICK AG TLOC100-…)
- [CVE-2025-59459](https://cve.now/CVE-2025-59459.md): Denial-of-service (DoS) via resource consumption (CVSS 5.5, SICK AG TLOC100-100)
- [CVE-2025-8432](https://cve.now/CVE-2025-8432.md): CentreonBI user account on the MBI server can execute commands as root by modifying script runned by the CRON (CVSS 8.4, Centreon Infra Monitoring)
- [CVE-2025-12261](https://cve.now/CVE-2025-12261.md): CodeAstro Gym Management System remove-announcement.php sql injection (CVSS 5.3, CodeAstro Gym Management System)
- [CVE-2025-12260](https://cve.now/CVE-2025-12260.md): TOTOLINK A3300R POST Parameter cstecgi.cgi setSyslogCfg stack-based overflow (CVSS 8.7, TOTOLINK A3300R)
- [CVE-2025-12259](https://cve.now/CVE-2025-12259.md): TOTOLINK A3300R POST Parameter cstecgi.cgi setScheduleCfg stack-based overflow (CVSS 8.7, TOTOLINK A3300R)
- [CVE-2025-12258](https://cve.now/CVE-2025-12258.md): TOTOLINK A3300R POST Parameter cstecgi.cg setOpModeCfg stack-based overflow (CVSS 8.7, TOTOLINK A3300R)
- [CVE-2025-12257](https://cve.now/CVE-2025-12257.md): SourceCodester Online Student Result System view\_result.php sql injection (CVSS 6.9, SourceCodester Online Student Result System)
- [CVE-2025-12256](https://cve.now/CVE-2025-12256.md): code-projects Online Event Judging System edit\_contestant.php sql injection (CVSS 5.3, code-projects Online Event Judging System)
- [CVE-2025-46583](https://cve.now/CVE-2025-46583.md): DOS Vulnerability in ZTE MC889A Pro product (CVSS 5.3, ZTE MC889A Pro)
- [CVE-2025-12255](https://cve.now/CVE-2025-12255.md): code-projects Online Event Judging System add\_contestant.php sql injection (CVSS 5.3, code-projects Online Event Judging System)
- [CVE-2025-12254](https://cve.now/CVE-2025-12254.md): code-projects Online Event Judging System add\_judge.php sql injection (CVSS 5.3, code-projects Online Event Judging System)
- [CVE-2025-12253](https://cve.now/CVE-2025-12253.md): AMTT Hotel Broadband Operation System get\_expiredtime.php sql injection (CVSS 6.9, AMTT Hotel Broadband Operation System)
- [CVE-2025-12080](https://cve.now/CVE-2025-12080.md): Intent Abuse in Google Messages for Wear OS for Silent Message Sending (CVSS 6.9, Google WearOS)
- [CVE-2025-46582](https://cve.now/CVE-2025-46582.md): Private Key Disclosure Vulnerability in ZTE ZXMP M721 Product (CVSS 7.7, ZTE ZXMP M721)
- [CVE-2025-12252](https://cve.now/CVE-2025-12252.md): code-projects Online Event Judging System action.php sql injection (CVSS 5.3, code-projects Online Event Judging System)
- [CVE-2025-12251](https://cve.now/CVE-2025-12251.md): OpenWGA Admin UI cross site scripting (CVSS 5.1, OpenWGA)
- [CVE-2025-12250](https://cve.now/CVE-2025-12250.md): OpenWGA TMLScript API WGA.File path traversal (CVSS 5.1, OpenWGA)
- [CVE-2025-12249](https://cve.now/CVE-2025-12249.md): Axosoft Scrum and Bug Tracking Edit Ticket csv injection (CVSS 5.3, Axosoft Scrum and Bug Tracking)
- [CVE-2025-12248](https://cve.now/CVE-2025-12248.md): CLTPHP search.html sql injection (CVSS 6.9, CLTPHP)
- [CVE-2025-12247](https://cve.now/CVE-2025-12247.md): Hasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search path (CVSS 7.3, Hasleo Backup Suite)
- [CVE-2025-11682](https://cve.now/CVE-2025-11682.md): Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty Platform (CVSS 7.1, Perx Technologies Customer Engagement & Loyalty Platform)
- [CVE-2025-12246](https://cve.now/CVE-2025-12246.md): chatwoot Admin IframeLoader.vue cross site scripting (CVSS 5.3, chatwoot)
- [CVE-2025-12245](https://cve.now/CVE-2025-12245.md): chatwoot Widget IFrameHelper.js initPostMessageCommunication origin validation (CVSS 6.9, chatwoot)
- [CVE-2025-12244](https://cve.now/CVE-2025-12244.md): code-projects Simple E-Banking System register.php cross site scripting (CVSS 5.3, code-projects Simple E-Banking System)
- [CVE-2025-12243](https://cve.now/CVE-2025-12243.md): code-projects Client Details System GET Parameter welcome.php sql injection (CVSS 5.3, code-projects Client Details System)
- [CVE-2025-12242](https://cve.now/CVE-2025-12242.md): CodeAstro Gym Management System check-attendance.php sql injection (CVSS 5.3, CodeAstro Gym Management System)
- [CVE-2025-12241](https://cve.now/CVE-2025-12241.md): TOTOLINK A3300R POST Parameter cstecgi.cgi setLanguageCfg stack-based overflow (CVSS 8.7, TOTOLINK A3300R)
- [CVE-2025-12055](https://cve.now/CVE-2025-12055.md): Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution System (CVSS 7.5, MPDV Mikrolab MIP · MPDV Mikrolab FEDRA +1)
- [CVE-2025-12240](https://cve.now/CVE-2025-12240.md): TOTOLINK A3300R cstecgi.cgi setDmzCfg buffer overflow (CVSS 8.7, TOTOLINK A3300R)
- [CVE-2025-12239](https://cve.now/CVE-2025-12239.md): TOTOLINK A3300R cstecgi.cgi setDdnsCfg buffer overflow (CVSS 8.7, TOTOLINK A3300R)
- [CVE-2025-12238](https://cve.now/CVE-2025-12238.md): code-projects Automated Voting System user.php sql injection (CVSS 5.3, code-projects Automated Voting System)
- [CVE-2025-12237](https://cve.now/CVE-2025-12237.md): projectworlds Advanced Library Management System index.php sql injection (CVSS 6.9, projectworlds Advanced Library Management System)
- [CVE-2025-12236](https://cve.now/CVE-2025-12236.md): Tenda CH22 DhcpListClient fromDhcpListClient buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12235](https://cve.now/CVE-2025-12235.md): Tenda CH22 SetIpBind fromSetIpBind buffer overflow (CVSS 8.6, Tenda CH22)
- [CVE-2025-12234](https://cve.now/CVE-2025-12234.md): Tenda CH22 SafeMacFilter fromSafeMacFilter buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12233](https://cve.now/CVE-2025-12233.md): Tenda CH22 SafeUrlFilter fromSafeUrlFilter buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12232](https://cve.now/CVE-2025-12232.md): Tenda CH22 SafeClientFilter fromSafeClientFilter buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-12231](https://cve.now/CVE-2025-12231.md): projectworlds Expense Management System Expense Categories create cross site scripting (CVSS 4.8, projectworlds Expense Management System)
- [CVE-2025-12230](https://cve.now/CVE-2025-12230.md): projectworlds Expense Management System Currency create cross site scripting (CVSS 4.8, projectworlds Expense Management System)
- [CVE-2025-11154](https://cve.now/CVE-2025-11154.md): IDonate \< 2.1.13 - Unauthenticated User Deletion (CVSS 5.4, IDonate)
- [CVE-2025-12229](https://cve.now/CVE-2025-12229.md): projectworlds Expense Management System Roles Page create cross site scripting (CVSS 4.8, projectworlds Expense Management System)
- [CVE-2025-12228](https://cve.now/CVE-2025-12228.md): projectworlds Expense Management System Users Page create cross site scripting (CVSS 4.8, projectworlds Expense Management System)
- [CVE-2025-12227](https://cve.now/CVE-2025-12227.md): projectworlds Gate Pass Management System add-pass.php cross site scripting (CVSS 5.1, projectworlds Gate Pass Management System)
- [CVE-2025-12226](https://cve.now/CVE-2025-12226.md): SourceCodester Best House Rental Management System admin\_class.php save\_house sql injection (CVSS 5.1, SourceCodester Best House Rental Management System)
- [CVE-2025-12225](https://cve.now/CVE-2025-12225.md): Tenda AC6 HTTP Request WifiGuestSet stack-based overflow (CVSS 8.7, Tenda AC6)
- [CVE-2025-12224](https://cve.now/CVE-2025-12224.md): Iqbolshoh php-business-website contact.php cross site scripting (CVSS 5.1, Iqbolshoh php-business-website)
- [CVE-2025-12223](https://cve.now/CVE-2025-12223.md): Bdtask Flight Booking Software Package Information package-information unrestricted upload (CVSS 5.3, Bdtask Flight Booking Software)
- [CVE-2025-12222](https://cve.now/CVE-2025-12222.md): Bdtask Flight Booking Software Deposit deposit unrestricted upload (CVSS 5.3, Bdtask Flight Booking Software)
- [CVE-2025-12215](https://cve.now/CVE-2025-12215.md): projectworlds Online Shopping System login\_submit.php sql injection (CVSS 6.9, projectworlds Online Shopping System)
- [CVE-2025-12214](https://cve.now/CVE-2025-12214.md): Tenda O3 sysAutoReboot GetValue stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2025-12213](https://cve.now/CVE-2025-12213.md): Tenda O3 setVlanConfig GetValue stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2025-12212](https://cve.now/CVE-2025-12212.md): Tenda O3 setNetworkService GetValue stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2025-12211](https://cve.now/CVE-2025-12211.md): Tenda O3 setDmzInfo GetValue stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2025-12210](https://cve.now/CVE-2025-12210.md): Tenda O3 AdvSetLanip GetValue stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2025-12209](https://cve.now/CVE-2025-12209.md): Tenda O3 setDhcpConfig GetValue stack-based overflow (CVSS 8.7, Tenda O3)
- [CVE-2025-12208](https://cve.now/CVE-2025-12208.md): SourceCodester Best House Rental Management System admin\_class.php login2 sql injection (CVSS 6.9, SourceCodester Best House Rental Management System)
- [CVE-2025-12207](https://cve.now/CVE-2025-12207.md): Kamailio Grammar Rule cfg.y yyerror\_at null pointer dereference (CVSS 4.8, Kamailio)
- [CVE-2025-12206](https://cve.now/CVE-2025-12206.md): Kamailio rvalue.c rve\_is\_constant null pointer dereference (CVSS 4.8, Kamailio)
- [CVE-2025-12205](https://cve.now/CVE-2025-12205.md): Kamailio Configuration File cfg.lex sr\_push\_yy\_state use after free (CVSS 4.8, Kamailio)
- [CVE-2025-48088](https://cve.now/CVE-2025-48088.md): WordPress Ultimate Addons for WPBakery Page Builder plugin \< 3.21.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Brainstorm\_Force Ultimate Addons for WPBakery Page Builder)
- [CVE-2025-58918](https://cve.now/CVE-2025-58918.md): WordPress Entrada theme \<= 5.7.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Waituk Entrada)
- [CVE-2025-12204](https://cve.now/CVE-2025-12204.md): Kamailio Configuration File rvalue.c rve\_destroy heap-based overflow (CVSS 4.8, Kamailio)
- [CVE-2025-12203](https://cve.now/CVE-2025-12203.md): givanz Vvveb Code Editor functions.php sanitizeFileName path traversal (CVSS 5.3, givanz Vvveb)
- [CVE-2025-62988](https://cve.now/CVE-2025-62988.md): WordPress Slider Templates plugin \<= 1.0.3 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, Codeless Slider Templates)
- [CVE-2025-62987](https://cve.now/CVE-2025-62987.md): WordPress Builderall Builder for WordPress plugin \<= 3.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Builderall Builder for WordPress)
- [CVE-2025-62986](https://cve.now/CVE-2025-62986.md): WordPress FanBridge signup plugin \<= 0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, FanBridge signup)
- [CVE-2025-62985](https://cve.now/CVE-2025-62985.md): WordPress Simple Pull Quote plugin \<= 1.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, llamaman Simple Pull Quote)
- [CVE-2025-62984](https://cve.now/CVE-2025-62984.md): WordPress WP AdCenter plugin \<= 2.6.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPeka WP AdCenter)
- [CVE-2025-62983](https://cve.now/CVE-2025-62983.md): WordPress Posts By Tag plugin \<= 3.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sudar Muthu Posts By Tag)
- [CVE-2025-62982](https://cve.now/CVE-2025-62982.md): WordPress Dynamic User Directory plugin \<= 2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Sarah Giles Dynamic User Directory)
- [CVE-2025-62981](https://cve.now/CVE-2025-62981.md): WordPress WP Gravity Forms Zoho CRM and Bigin plugin \<= 1.2.8 - Open Redirection vulnerability (CVSS 4.7, CRM Perks WP Gravity Forms Zoho CRM and Bigin)
- [CVE-2025-62980](https://cve.now/CVE-2025-62980.md): WordPress Persian Admnin Fonts plugin \<= 4.1.03 - Broken Access Control vulnerability (CVSS 5.4, MDZ Persian Admnin Fonts)
- [CVE-2025-62979](https://cve.now/CVE-2025-62979.md): WordPress ACF to REST API plugin \<= 3.3.4 - Sensitive Data Exposure vulnerability (CVSS 5.3, airesvsg ACF to REST API)
- [CVE-2025-62978](https://cve.now/CVE-2025-62978.md): WordPress KiotViet Sync plugin \<= 1.8.5 - Broken Access Control vulnerability (CVSS 4.3, KiotViet Sync)
- [CVE-2025-62977](https://cve.now/CVE-2025-62977.md): WordPress 百度站长SEO合集(支持百度/神马/Bing/头条推送) plugin \<= 2.1.4 - Broken Access Control vulnerability (CVSS 5.3, 沃之涛 百度站长SEO合集)
- [CVE-2025-62976](https://cve.now/CVE-2025-62976.md): WordPress Sendle Shipping plugin \<= 6.02 - Broken Access Control vulnerability (CVSS 5.3, Joovii Sendle Shipping)
- [CVE-2025-62975](https://cve.now/CVE-2025-62975.md): WordPress Raychat plugin \<= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Raychat)
- [CVE-2025-62974](https://cve.now/CVE-2025-62974.md): WordPress Headline Analyzer plugin \<= 1.3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CoSchedule Headline Analyzer)
- [CVE-2025-62973](https://cve.now/CVE-2025-62973.md): WordPress BuddyForms plugin \<= 2.10.2 - Broken Access Control vulnerability (CVSS 5.3, Themekraft BuddyForms)
- [CVE-2025-62972](https://cve.now/CVE-2025-62972.md): WordPress WebinarPress plugin \<= 1.33.28 - Broken Access Control vulnerability (CVSS 4.3, WPWebinarSystem WebinarPress)
- [CVE-2025-62971](https://cve.now/CVE-2025-62971.md): WordPress Attesa Extra plugin \<= 1.4.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, CrestaProject Attesa Extra)
- [CVE-2025-62970](https://cve.now/CVE-2025-62970.md): WordPress Link Whisper Free plugin \<= 0.9.2 - Broken Access Control vulnerability (CVSS 5.3, Spencer Haws Link Whisper Free)
- [CVE-2025-62969](https://cve.now/CVE-2025-62969.md): WordPress NextMove Lite plugin \<= 2.23.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, XLPlugins NextMove Lite)
- [CVE-2025-62968](https://cve.now/CVE-2025-62968.md): WordPress WP Last Modified Info plugin \<= 1.9.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Sayan Datta WP Last Modified Info)
- [CVE-2025-62967](https://cve.now/CVE-2025-62967.md): WordPress DirectoryPress plugin \<= 3.6.25 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Designinvento DirectoryPress)
- [CVE-2025-62966](https://cve.now/CVE-2025-62966.md): WordPress GoCache plugin \<= 1.3.6 - Broken Access Control vulnerability (CVSS 5.4, Apiki GoCache)
- [CVE-2025-62965](https://cve.now/CVE-2025-62965.md): WordPress Admin Management Xtended plugin \<= 2.5.1 - Broken Access Control vulnerability (CVSS 4.3, wpseek Admin Management Xtended)
- [CVE-2025-62964](https://cve.now/CVE-2025-62964.md): WordPress MDTF plugin \<= 1.3.6 - Broken Access Control vulnerability (CVSS 5.3, RealMag777 MDTF)
- [CVE-2025-62963](https://cve.now/CVE-2025-62963.md): WordPress Estatik plugin \<= 4.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Estatik)
- [CVE-2025-62962](https://cve.now/CVE-2025-62962.md): WordPress CloudSearch plugin \<= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Andrea Landonio CloudSearch)
- [CVE-2025-62959](https://cve.now/CVE-2025-62959.md): WordPress Paid Videochat Turnkey Site plugin \<= 7.3.23 - Remote Code Execution (RCE) vulnerability (CVSS 9.1, videowhisper Paid Videochat Turnkey Site)
- [CVE-2025-62958](https://cve.now/CVE-2025-62958.md): WordPress Simple Content Templates for Blog Posts & Pages plugin \<= 2.2.61 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Clifton Griffin Simple Content Templates for Blog Posts & P…)
- [CVE-2025-62957](https://cve.now/CVE-2025-62957.md): WordPress NikanWP WooCommerce Reporting plugin \<= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, NikanWP WooCommerce Reporting)
- [CVE-2025-62956](https://cve.now/CVE-2025-62956.md): WordPress Reloadly plugin \<= 2.0.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, iseremet Reloadly)
- [CVE-2025-62954](https://cve.now/CVE-2025-62954.md): WordPress Revive Old Posts plugin \<= 9.3.3 - Broken Access Control vulnerability (CVSS 4.3, rsocial Revive Old Posts)
- [CVE-2025-62953](https://cve.now/CVE-2025-62953.md): WordPress Welcart e-Commerce plugin \<= 2.11.24 - Broken Access Control vulnerability (CVSS 4.3, info@welcart Welcart e-Commerce)
- [CVE-2025-62952](https://cve.now/CVE-2025-62952.md): WordPress ChatBot plugin \<= 7.7.3 - Broken Access Control vulnerability (CVSS 4.3, QuantumCloud ChatBot)
- [CVE-2025-62951](https://cve.now/CVE-2025-62951.md): WordPress H5P plugin \<= 1.16.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, icc0rz H5P)
- [CVE-2025-62949](https://cve.now/CVE-2025-62949.md): WordPress Activity Plus Reloaded for BuddyPress plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, BuddyDev Activity Plus Reloaded for BuddyPress)
- [CVE-2025-62948](https://cve.now/CVE-2025-62948.md): WordPress Date counter plugin \<= 2.0.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Konstantin Pankratov Date counter)
- [CVE-2025-62947](https://cve.now/CVE-2025-62947.md): WordPress Publitio plugin \<= 2.2.5 - Sensitive Data Exposure vulnerability (CVSS 5.0, Publitio)
- [CVE-2025-62946](https://cve.now/CVE-2025-62946.md): WordPress Everest Backup plugin \<= 2.3.8 - Broken Access Control vulnerability (CVSS 5.3, everestthemes Everest Backup)
- [CVE-2025-62945](https://cve.now/CVE-2025-62945.md): WordPress Did Prestashop Display plugin \<= 1.0.30 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Eduard Pinuaga Linares Did Prestashop Display)
- [CVE-2025-62944](https://cve.now/CVE-2025-62944.md): WordPress MSTW CSV EXPORTER plugin \<= 1.4 - Broken Access Control vulnerability (CVSS 5.3, Mark O'Donnell MSTW CSV EXPORTER)
- [CVE-2025-62943](https://cve.now/CVE-2025-62943.md): WordPress Next Page, Not Next Post plugin \<= 0.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Matt McInvale Next Page, Not Next Post)
- [CVE-2025-62942](https://cve.now/CVE-2025-62942.md): WordPress WP Mapbox GL JS Maps plugin \<= 3.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tempranova WP Mapbox GL JS Maps)
- [CVE-2025-62941](https://cve.now/CVE-2025-62941.md): WordPress Events Maker by dFactory plugin \<= 1.6.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Events Maker by dFactory)
- [CVE-2025-62940](https://cve.now/CVE-2025-62940.md): WordPress Blox Lite plugin \<= 1.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Nick Diego Blox Lite)
- [CVE-2025-62939](https://cve.now/CVE-2025-62939.md): WordPress Open Currency Converter plugin \<= 1.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Joe Open Currency Converter)
- [CVE-2025-62938](https://cve.now/CVE-2025-62938.md): WordPress Reoon Email Verifier plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 4.3, Reoon Technology Reoon Email Verifier)
- [CVE-2025-62937](https://cve.now/CVE-2025-62937.md): WordPress Post List Featured Image plugin \<= 0.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Johnny Post List Featured Image)
- [CVE-2025-62936](https://cve.now/CVE-2025-62936.md): WordPress xSmart theme \<= 1.2.9.4 - Content Injection vulnerability (CVSS 4.3, Jthemes xSmart)
- [CVE-2025-62935](https://cve.now/CVE-2025-62935.md): WordPress Open Close WooCommerce Store plugin \<= 5.0.0 - Broken Access Control vulnerability (CVSS 4.3, StackWC Open Close WooCommerce Store)
- [CVE-2025-62934](https://cve.now/CVE-2025-62934.md): WordPress WP Business Hours plugin \<= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Mejar WP Business Hours)
- [CVE-2025-62933](https://cve.now/CVE-2025-62933.md): WordPress Awesome Testimonials plugin \<= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Prakash Awesome Testimonials)
- [CVE-2025-62932](https://cve.now/CVE-2025-62932.md): WordPress Table Block by RioVizual plugin \<= 3.0.0 - Broken Access Control vulnerability (CVSS 4.3, wprio Table Block by RioVizual)
- [CVE-2025-62931](https://cve.now/CVE-2025-62931.md): WordPress MSN Partner Hub plugin \<= 2.9 - Broken Access Control vulnerability (CVSS 4.3, microsoftstart MSN Partner Hub)
- [CVE-2025-62930](https://cve.now/CVE-2025-62930.md): WordPress MapSVG plugin \<= 8.7.22 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RomanCode MapSVG)
- [CVE-2025-62929](https://cve.now/CVE-2025-62929.md): WordPress Testimonial Slider plugin \<= 2.0.15 - Broken Access Control vulnerability (CVSS 6.5, PickPlugins Testimonial Slider)
- [CVE-2025-62928](https://cve.now/CVE-2025-62928.md): WordPress SEO Meta Description Updater plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 4.3, Joby Joseph SEO Meta Description Updater)
- [CVE-2025-62927](https://cve.now/CVE-2025-62927.md): WordPress Nelio Content plugin \<= 4.0.5 - Broken Access Control vulnerability (CVSS 6.5, Nelio Software Nelio Content)
- [CVE-2025-62925](https://cve.now/CVE-2025-62925.md): WordPress Conversios.io plugin \<= 7.2.13 - Broken Access Control vulnerability (CVSS 5.4, Conversios.io)
- [CVE-2025-62924](https://cve.now/CVE-2025-62924.md): WordPress Post Grid and Gutenberg Blocks plugin \<= 2.3.17 - Broken Access Control vulnerability (CVSS 6.5, PickPlugins Post Grid and Gutenberg Blocks)
- [CVE-2025-62923](https://cve.now/CVE-2025-62923.md): WordPress Marquee Addons for Elementor plugin \<= 3.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Debuggers Studio Marquee Addons for Elementor)
- [CVE-2025-62922](https://cve.now/CVE-2025-62922.md): WordPress Export Categories plugin \<= 1.0 - Broken Access Control vulnerability (CVSS 5.3, Shambhu Patnaik Export Categories)
- [CVE-2025-62921](https://cve.now/CVE-2025-62921.md): WordPress Bulk Auto Image Title Attribute plugin \<= 2.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Pagup Bulk Auto Image Title Attribute)
- [CVE-2025-62920](https://cve.now/CVE-2025-62920.md): WordPress USERCENTRICS CMP plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, webnique USERCENTRICS CMP)
- [CVE-2025-62919](https://cve.now/CVE-2025-62919.md): WordPress TS Demo Importer plugin \<= 0.1.3 - Broken Access Control vulnerability (CVSS 5.4, themeshopy TS Demo Importer)
- [CVE-2025-62918](https://cve.now/CVE-2025-62918.md): WordPress IgnitionDeck plugin \<= 2.0.15 - Broken Access Control vulnerability (CVSS 5.4, ignitionwp IgnitionDeck)
- [CVE-2025-62917](https://cve.now/CVE-2025-62917.md): WordPress Tooltipy plugin \<= 5.5.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jamel.Z Tooltipy)
- [CVE-2025-62916](https://cve.now/CVE-2025-62916.md): WordPress Flights & Hotels Booking WP Plugin plugin \<= 3.1 - Broken Access Control vulnerability (CVSS 5.4, Travon WP Flights & Hotels Booking WP Plugin)
- [CVE-2025-62915](https://cve.now/CVE-2025-62915.md): WordPress SMS Contact Form 7 Notifications by ClickSend plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 4.3, SMS Contact Form 7 Notifications by ClickSend)
- [CVE-2025-62913](https://cve.now/CVE-2025-62913.md): WordPress Opal Service plugin \<= 1.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpopal Opal Service)
- [CVE-2025-62912](https://cve.now/CVE-2025-62912.md): WordPress SiteGround Email Marketing plugin \<= 1.7.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SiteGround Email Marketing)
- [CVE-2025-62911](https://cve.now/CVE-2025-62911.md): WordPress Rock Convert plugin \<= 3.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rock Content Rock Convert)
- [CVE-2025-62910](https://cve.now/CVE-2025-62910.md): WordPress Video Gallery by Huzzaz plugin \<= 10.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, deshine Video Gallery by Huzzaz)
- [CVE-2025-62909](https://cve.now/CVE-2025-62909.md): WordPress Smart WeTransfer plugin \<= 1.3 - Broken Access Control vulnerability (CVSS 4.3, mrityunjay Smart WeTransfer)
- [CVE-2025-62907](https://cve.now/CVE-2025-62907.md): WordPress Custom Post Type Attachment plugin \<= 3.4.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, aviplugins.com Custom Post Type Attachment)
- [CVE-2025-62906](https://cve.now/CVE-2025-62906.md): WordPress Referral Link Tracker plugin \<= 1.1.4 - Broken Access Control vulnerability (CVSS 4.3, epiphanyit321 Referral Link Tracker)
- [CVE-2025-62905](https://cve.now/CVE-2025-62905.md): WordPress Query Posts plugin \<= 0.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Justin Tadlock Query Posts)
- [CVE-2025-62904](https://cve.now/CVE-2025-62904.md): WordPress WP Geo plugin \<= 3.5.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Ben Huson WP Geo)
- [CVE-2025-62903](https://cve.now/CVE-2025-62903.md): WordPress WPC Smart Messages for WooCommerce plugin \<= 4.2.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPClever WPC Smart Messages for WooCommerce)
- [CVE-2025-62902](https://cve.now/CVE-2025-62902.md): WordPress WP Popup Builder plugin \<= 1.3.8 - Sensitive Data Exposure vulnerability (CVSS 5.3, ThemeHunk WP Popup Builder)
- [CVE-2025-62900](https://cve.now/CVE-2025-62900.md): WordPress Popular Posts by Webline plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WeblineIndia Popular Posts by Webline)
- [CVE-2025-62899](https://cve.now/CVE-2025-62899.md): WordPress Photospace Responsive plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, THRIVE - Web Design Gold Coast Photospace Responsive)
- [CVE-2025-62898](https://cve.now/CVE-2025-62898.md): WordPress Links shortcode plugin \<= 1.8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Maarten Links shortcode)
- [CVE-2025-62897](https://cve.now/CVE-2025-62897.md): WordPress WP Recipe Maker plugin \< 10.1.0 - Content Injection vulnerability (CVSS 5.3, Brecht WP Recipe Maker)
- [CVE-2025-62896](https://cve.now/CVE-2025-62896.md): WordPress Multilang Contact Form plugin \<= 1.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, digitaldonkey Multilang Contact Form)
- [CVE-2025-62895](https://cve.now/CVE-2025-62895.md): WordPress Atarim plugin \<= 4.2.1 - Sensitive Data Exposure vulnerability (CVSS 5.3, Vito Peleg Atarim)
- [CVE-2025-62894](https://cve.now/CVE-2025-62894.md): WordPress ACF Recent Posts Widget plugin \<= 5.9.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, magicoders ACF Recent Posts Widget)
- [CVE-2025-62892](https://cve.now/CVE-2025-62892.md): WordPress Sunshine Photo Cart plugin \<= 3.5.3 - Broken Access Control vulnerability (CVSS 5.3, sunshinephotocart Sunshine Photo Cart)
- [CVE-2025-62891](https://cve.now/CVE-2025-62891.md): WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin \<= 0.5.8.5 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Jory Hogeveen Off-Canvas Sidebars & Menus)
- [CVE-2025-62890](https://cve.now/CVE-2025-62890.md): WordPress Premmerce Brands for WooCommerce plugin \<= 1.2.13 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Premmerce Brands for WooCommerce)
- [CVE-2025-62889](https://cve.now/CVE-2025-62889.md): WordPress King Addons for Elementor plugin \<= 51.1.61 - Broken Access Control vulnerability (CVSS 6.5, KingAddons.com King Addons for Elementor)
- [CVE-2025-62887](https://cve.now/CVE-2025-62887.md): WordPress King Addons for Elementor plugin \<= 51.1.61 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, KingAddons.com King Addons for Elementor)
- [CVE-2025-62886](https://cve.now/CVE-2025-62886.md): WordPress Pricing Table builder plugin \<= 1.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, wpdevart Pricing Table builder)
- [CVE-2025-62885](https://cve.now/CVE-2025-62885.md): WordPress WP VR plugin \<= 8.5.48 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, RexTheme WP VR)
- [CVE-2025-62884](https://cve.now/CVE-2025-62884.md): WordPress Coupon Affiliates plugin \<= 7.2.0 - Broken Access Control vulnerability (CVSS 5.3, Elliot Sowersby / RelyWP Coupon Affiliates)
- [CVE-2025-62883](https://cve.now/CVE-2025-62883.md): WordPress Premmerce User Roles plugin \<= 1.0.13 - Broken Access Control vulnerability (CVSS 4.3, Premmerce User Roles)
- [CVE-2025-62882](https://cve.now/CVE-2025-62882.md): WordPress Seriously Simple Podcasting plugin \<= 3.13.0 - Broken Access Control vulnerability (CVSS 4.3, Craig Hewitt Seriously Simple Podcasting)
- [CVE-2025-62881](https://cve.now/CVE-2025-62881.md): WordPress WP-Lister Lite for eBay plugin \<= 3.8.3 - Broken Access Control vulnerability (CVSS 4.3, WP Lab WP-Lister Lite for eBay)
- [CVE-2025-12202](https://cve.now/CVE-2025-12202.md): ajayrandhawa User-Management-PHP-MYSQL web cross-site request forgery (CVSS 5.3, ajayrandhawa User-Management-PHP-MYSQL web)
- [CVE-2025-12201](https://cve.now/CVE-2025-12201.md): ajayrandhawa User-Management-PHP-MYSQL User Management edit-user.php unrestricted upload (CVSS 5.1, ajayrandhawa User-Management-PHP-MYSQL)
- [CVE-2025-6601](https://cve.now/CVE-2025-6601.md): Business Logic Errors in GitLab (CVSS 2.7, GitLab)
- [CVE-2025-10497](https://cve.now/CVE-2025-10497.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2025-11971](https://cve.now/CVE-2025-11971.md): Incorrect Authorization in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-11974](https://cve.now/CVE-2025-11974.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-11447](https://cve.now/CVE-2025-11447.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 7.5, GitLab)
- [CVE-2023-37749](https://cve.now/CVE-2023-37749.md): Incorrect access control in the REST API endpoint of HubSpot v1.29441 allows unauthenticated attackers to view users' data without proper au (CVSS 5.3)
- [CVE-2023-49440](https://cve.now/CVE-2023-49440.md): AhnLab EPP 1.0.15 is vulnerable to SQL Injection via the "preview parameter." (CVSS 8.8)
- [CVE-2025-27222](https://cve.now/CVE-2025-27222.md): TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/getCobrandingData endpoint to retrieve files. (CVSS 8.6)
- [CVE-2025-27223](https://cve.now/CVE-2025-27223.md): TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPor (CVSS 7.5)
- [CVE-2025-27224](https://cve.now/CVE-2025-27224.md): TRUfusion Enterprise through 7.10.4.0 uses the /trufusionPortal/fileupload endpoint to upload files. (CVSS 9.8)
- [CVE-2025-27225](https://cve.now/CVE-2025-27225.md): TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal\_admin\_contact\_login.jsp endpoint to unauthenticated users. (CVSS 7.5)
- [CVE-2025-52263](https://cve.now/CVE-2025-52263.md): An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to (CVSS 8.0)
- [CVE-2025-52264](https://cve.now/CVE-2025-52264.md): StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a stack overflow via the cgiMain function at download.cgi. (CVSS 8.0)
- [CVE-2025-52268](https://cve.now/CVE-2025-52268.md): StarCharge Artemis AC Charger 7-22 kW v1.0.4 was discovered to contain a hardcoded AES key which allows attackers to forge or decrypt valid (CVSS 7.5)
- [CVE-2025-54965](https://cve.now/CVE-2025-54965.md): An XSS issue was discovered in BAE SOCET GXP before 4.6.0.2. (CVSS 6.1)
- [CVE-2025-54967](https://cve.now/CVE-2025-54967.md): An issue was discovered in BAE SOCET GXP before 4.6.0.3. (CVSS 6.5)
- [CVE-2025-54968](https://cve.now/CVE-2025-54968.md): An issue was discovered in BAE SOCET GXP before 4.6.0.2. (CVSS 8.8)
- [CVE-2025-54969](https://cve.now/CVE-2025-54969.md): An issue was discovered in BAE SOCET GXP before 4.6.0.2. (CVSS 6.1)
- [CVE-2025-54970](https://cve.now/CVE-2025-54970.md): An issue was discovered in BAE SOCET GXP before 4.6.0.2. (CVSS 6.5)
- [CVE-2025-60291](https://cve.now/CVE-2025-60291.md): An issue was discovered in eTimeTrackLite Web thru 12.0 (20250704). (CVSS 9.1)
- [CVE-2025-60424](https://cve.now/CVE-2025-60424.md): A lack of rate limiting in the OTP verification component of Nagios Fusion v2024R1.2 and v2024R2 allows attackers to bypass authentication v (CVSS 7.6)
- [CVE-2025-60425](https://cve.now/CVE-2025-60425.md): Nagios Fusion v2024R1.2 and v2024R2 does not invalidate already existing session tokens when the two-factor authentication mechanism is enab (CVSS 8.6)
- [CVE-2025-60791](https://cve.now/CVE-2025-60791.md): Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information in Memory. (CVSS 6.2)
- [CVE-2025-60982](https://cve.now/CVE-2025-60982.md): IDOR vulnerability in Educare ERP 1.0 (2025-04-22) allows unauthorized access to sensitive data via manipulated object references. (CVSS 5.4)
- [CVE-2025-60983](https://cve.now/CVE-2025-60983.md): Reflected Cross Site Scripting vulnerability in Rubikon Banking Solution 4.0.3 in the "Search For Customers Information" endpoints. (CVSS 5.4)
- [CVE-2025-61099](https://cve.now/CVE-2025-61099.md): FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the opaque\_info\_detail function at ospf\_opa (CVSS 7.5)
- [CVE-2025-61100](https://cve.now/CVE-2025-61100.md): FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the ospf\_opaque\_lsa\_dump function at ospf\_o (CVSS 7.5)
- [CVE-2025-61101](https://cve.now/CVE-2025-61101.md): FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show\_vty\_ext\_link\_rmt\_itf\_addr function (CVSS 7.5)
- [CVE-2025-61102](https://cve.now/CVE-2025-61102.md): FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show\_vty\_ext\_link\_adj\_sid function at o (CVSS 7.5)
- [CVE-2025-61105](https://cve.now/CVE-2025-61105.md): FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show\_vty\_link\_info function at ospf\_ext (CVSS 7.5)
- [CVE-2025-61247](https://cve.now/CVE-2025-61247.md): indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in the password parameter of login.php. (CVSS 8.2)
- [CVE-2025-61385](https://cve.now/CVE-2025-61385.md): SQL injection vulnerability in tlocke pg8000 1.31.4 allows remote attackers to execute arbitrary SQL commands via a specially crafted Python (CVSS 9.6, pg8000)
- [CVE-2025-61481](https://cve.now/CVE-2025-61481.md): An issue in MikroTik RouterOS v.7.14.2 and SwOS v.2.18 exposes the WebFig management interface over cleartext HTTP by default, allowing an o (CVSS 10.0)
- [CVE-2025-61482](https://cve.now/CVE-2025-61482.md): Improper handling of OTP/TOTP/HOTP values in NetKnights GmbH privacyIDEA Authenticator v.4.3.0 on Android allows local attackers with root a (CVSS 7.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-10-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.