Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
773 results · page 14 of 16
Oct 5, 2025A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab.CVE-2025-11289 · Other software · westboy · reported by VulDBLow 1.9
A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/main/java/com/zhiliao/common/template/TemplateFileServiceImpl.java of the component Template Management Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CicadasCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2025A vulnerability was determined in samanhappy MCPHub up to 0.9.10.CVE-2025-11286 · Other software · samanhappy · reported by VulDBLow 2
A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component MCPRouter Service. This manipulation of the argument baseUrl causes server-side request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MCPHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2025A vulnerability was determined in Frappe LMS 2.35.0.CVE-2025-11283 · Other software · Frappe · reported by VulDBLow 1.9
A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 4, 2025A vulnerability was determined in Open Asset Import Library Assimp 6.0.2.CVE-2025-11274 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0.CVE-2025-11139 · Other software · Bjskzy · reported by VulDBLow 2.1
A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Zhiyou ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-11117 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formWrlExtraGet of the file /goform/GstDhcpSetSer. This manipulation of the argument dips causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2025A vulnerability was determined in D-Link DIR-823X 250416.CVE-2025-11099 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2025A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464.CVE-2025-11089 · Other software · kidaze · reported by VulDBMedium 5.5
A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This impacts an unknown function of the file /Profilers/PriProfile/COUNT3s4.php. Executing manipulation of the argument cbranch can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- CourseSelectionSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2025A vulnerability was determined in westboy CicadasCMS 1.0.CVE-2025-11069 · Other software · westboy · reported by VulDBLow 1.9
A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Add Department Handler. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CicadasCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025A vulnerability was determined in Jinher OA 2.0.CVE-2025-11035 · Other software · Jinher · reported by VulDBLow 2.1
A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025A vulnerability was determined in givanz Vvveb up to 1.0.7.2.CVE-2025-11026 · Other software · givanz · reported by VulDBLow 2
A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 26, 2025A vulnerability was determined in BehaviorTree up to 4.7.0.CVE-2025-11012 · Other software · Behaviortree · reported by VulDBLow 1.9
A vulnerability was determined in BehaviorTree up to 4.7.0. This affects the function ParseScript of the file /src/script_parser.cpp of the component Diagnostic Message Handler. Executing manipulation of the argument error_msgs_buffer can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. This patch is called cb6c7514efa628adb8180b58b4c9ccdebbe096e3. A patch should be applied to remediate this issue.
- Product
- Behaviortree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025A vulnerability was determined in Open Babel up to 3.1.1.CVE-2025-11000 · Other software · Openbabel · reported by VulDBLow 1.9
A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
- Product
- Open Babel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.CVE-2025-10992 · Other software · roncoo · reported by VulDBMedium 5.5
A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- roncoo-pay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in YunaiV yudao-cloud up to 2025.09.CVE-2025-10987 · Other software · YunaiV · reported by VulDBLow 2.1
A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor confirms: "The controllers check the relevant update permission and obtain the acting user ID from the authenticated server context. The services require CRM OWNER permission and call transferPermission, which explicitly rejects a caller who is neither the owner nor an authorized CRM administrator."
- Product
- yudao-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in JeecgBoot up to 3.8.2.CVE-2025-10976 · Other software · Jeecg · reported by VulDBLow 1.3
A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in Wavlink NU516U1 M16U1_V240425.CVE-2025-10961 · Other software · Wavlink · reported by VulDBMedium 5.1
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to command injection. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NU516U1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743.CVE-2025-10950 · Other software · geyang · reported by VulDBLow 2.1
A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function log_handler of the file ml_logger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- ml-logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1.CVE-2025-10941 · Other software · Topaz · reported by VulDBHigh 8.5
A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0.40D.msi of the component Installer. Executing manipulation can lead to permission issues. The attack needs to be launched locally. You should upgrade the affected component. The vendor explains, that "this vulnerability was detected at the beginning of 2025, it was remediated because the latest published version of the installer no longer uses "nssm," which is responsible for this vulnerability".
- Product
- SERVCore Teller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comvuldb.com
Sep 23, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-10846 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Sep 22, 2025A vulnerability was determined in 1000projects Bookstore Management System 1.0.CVE-2025-10833 · Other software · 1000projects · reported by VulDBMedium 5.5
A vulnerability was determined in 1000projects Bookstore Management System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of the argument unm causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Bookstore Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025A vulnerability was determined in axboe fio up to 3.41.CVE-2025-10824 · Other software · axboe · reported by VulDBLow 1.9
A vulnerability was determined in axboe fio up to 3.41. This impacts the function __parse_jobs_ini of the file init.c. Executing manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized.
- Product
- fio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025A vulnerability was determined in D-Link DIR-823X 240126/240802/250416.CVE-2025-10814 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025A vulnerability was determined in CodeAstro Simple Pharmacy Management 1.0.CVE-2025-10780 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was determined in CodeAstro Simple Pharmacy Management 1.0. This affects an unknown function of the file /view.php. This manipulation of the argument bar_code causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- Simple Pharmacy Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Sep 21, 2025A vulnerability was determined in jeecgboot JimuReport up to 2.1.2.CVE-2025-10771 · Other software · jeecgboot · reported by VulDBLow 2.1
A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. Executing manipulation of the argument clientRerouteServerListJNDIName can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- JimuReport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2025A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab.CVE-2025-10763 · Other software · academico-sis · reported by VulDBLow 2.1
A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab. Affected by this issue is some unknown functionality of the file /edit-photo of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- academico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 19, 2025A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android.CVE-2025-10721 · Other software · Webull · reported by VulDBLow 1.9
A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android. This vulnerability affects unknown code of the file AndroidManifest.xml. This manipulation causes improper export of android application components. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Investing & Trading App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025A vulnerability was determined in D-Link DIR-852 1.00CN B09.CVE-2025-10629 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgi_main of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-852
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464.CVE-2025-10597 · Other software · kidaze · reported by VulDBMedium 6.9
A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This vulnerability affects unknown code of the file /Profilers/PriProfile/COUNT2.php. This manipulation of the argument cname causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
- Product
- CourseSelectionSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14.CVE-2025-10442 · Network & remote access · Tenda · reported by VulDBLow 2.1
A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- AC9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0.CVE-2025-10433 · Other software · 1Panel-dev · reported by VulDBLow 2.1
A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/debug. Executing manipulation of the argument code can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.1 is capable of addressing this issue. It is suggested to upgrade the affected component.
- Product
- MaxKB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0.CVE-2025-10424 · Other software · 1000projects · reported by VulDBMedium 5.5
A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/faculty_controller.php. This manipulation of the argument new_image causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Online Student Project Report Submission and Evaluation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2025A vulnerability was determined in codesiddhant Jasmin Ransomware up to 1.0.1.CVE-2025-10387 · Other software · codesiddhant · reported by VulDBLow 2.1
A vulnerability was determined in codesiddhant Jasmin Ransomware up to 1.0.1. This vulnerability affects unknown code of the file /handshake.php. This manipulation of the argument machine_name/computer_user/os/date/time/ip/location/systemid/password causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jasmin Ransomware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2025A vulnerability was determined in MiczFlor RPi-Jukebox-RFID up to 2.8.0.CVE-2025-10369 · Other software · MiczFlor · reported by VulDBLow 2
A vulnerability was determined in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This affects an unknown part of the file /htdocs/cardRegisterNew.php. Executing manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RPi-Jukebox-RFID
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025A vulnerability was determined in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3.CVE-2025-10340 · Other software · WhatCD · reported by VulDBLow 2
A vulnerability was determined in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3. The affected element is an unknown function of the file /sections/tools/managers/change_log.php of the component Commit Message Handler. Executing manipulation of the argument Message can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
- Product
- Gazelle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025A vulnerability was determined in Wavlink WL-WN578W2 221110.CVE-2025-10324 · Other software · Wavlink · reported by VulDBMedium 5.5
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects the function sub_401C5C of the file firewall.cgi. This manipulation of the argument pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WL-WN578W2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025A vulnerability was determined in erjinzhi 10OA 1.0.CVE-2025-10272 · Other software · erjinzhi · reported by VulDBLow 2.1
A vulnerability was determined in erjinzhi 10OA 1.0. Affected is an unknown function of the file /trial/mvc/catalogue. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 10OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0.CVE-2025-10255 · Other software · Ascensio System SIA · reported by VulDBLow 2
A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of the component Comment Handler. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches."
- Product
- OnlyOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025A vulnerability was determined in D-Link DIR-823X up to 250416.CVE-2025-10123 · Network & remote access · D-Link · reported by VulDBMedium 5.5
A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025A vulnerability was determined in SiempreCMS up to 1.3.6.CVE-2025-10115 · Other software · reported by VulDBMedium 5.5
A vulnerability was determined in SiempreCMS up to 1.3.6. This affects an unknown part of the file user_search_ajax.php. This manipulation of the argument name/userName causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025A vulnerability was determined in SimStudioAI sim up to 1.0.0.CVE-2025-10096 · Other software · SimStudioAI · reported by VulDBLow 2.1
A vulnerability was determined in SimStudioAI sim up to 1.0.0. This affects an unknown function of the file apps/sim/app/api/files/parse/route.ts. Executing manipulation of the argument filePath can lead to server-side request forgery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 3424a338b763115f0269b209e777608e4cd31785. Applying a patch is advised to resolve this issue.
- Product
- sim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-10073 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506.CVE-2025-9935 · Other software · TOTOLINK · reported by VulDBMedium 5.5
A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- N600R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2025A vulnerability was determined in Tenda CP6 11.10.00.243.CVE-2025-9828 · Network & remote access · Tenda · reported by VulDBLow 2.9
A vulnerability was determined in Tenda CP6 11.10.00.243. The affected element is the function sub_2B7D04 of the component uhttp. Executing manipulation can lead to risky cryptographic algorithm. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized.
- Product
- CP6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-9812 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Executing manipulation of the argument cmdinput can lead to buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20.CVE-2025-9806 · Network & remote access · Tenda · reported by VulDBLow 0.9
A vulnerability was determined in Tenda F1202 1.2.0.9/1.2.0.14/1.2.0.20. Impacted is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation with the input Fireitup causes hard-coded credentials. The attack can only be executed locally. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been publicly disclosed and may be utilized.
- Product
- F1202
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0.CVE-2025-9797 · Other software · mrvautin · reported by VulDBLow 1.9
A vulnerability was determined in mrvautin expressCart up to b31302f4e99c3293bd742c6d076a721e168118b0. This impacts an unknown function of the file /admin/product/edit/ of the component Edit Product Page. This manipulation causes injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available.
- Product
- expressCart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423.CVE-2025-9783 · Other software · TOTOLINK · reported by VulDBHigh 7.4
A vulnerability was determined in TOTOLINK A702R 4.0.0-B20211108.1423. This issue affects the function sub_418030 of the file /boafrm/formParentControl. Executing manipulation of the argument submit-url can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- A702R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-9748 · Network & remote access · Tenda · reported by VulDBHigh 8.7
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected by this issue is the function fromIpsecitem of the file /goform/IPSECsave of the component httpd. Executing manipulation of the argument ipsecno can lead to stack-based buffer overflow. The attack may be performed from remote.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2025A vulnerability was determined in Tenda AC9 15.03.05.19.CVE-2025-9731 · Network & remote access · Tenda · reported by VulDBLow 1.1
A vulnerability was determined in Tenda AC9 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/shadow of the component Administrative Interface. This manipulation causes hard-coded credentials. It is possible to launch the attack on the local host. The attack's complexity is rated as high. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized.
- Product
- AC9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.