Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,382 results · page 15 of 28
Oct 5, 2025A vulnerability was determined in Belkin F9K1015 1.00.10.CVE-2025-11298 · Other software · Belkin · reported by VulDBLow 2.1
A vulnerability was determined in Belkin F9K1015 1.00.10. Impacted is an unknown function of the file /goform/formSetWanStatic. Executing a manipulation of the argument m_wan_ipaddr can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- F9K1015
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2025A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab.CVE-2025-11289 · Other software · westboy · reported by VulDBLow 1.9
A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/main/java/com/zhiliao/common/template/TemplateFileServiceImpl.java of the component Template Management Page. This manipulation causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CicadasCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2025A vulnerability was determined in samanhappy MCPHub up to 0.9.10.CVE-2025-11286 · Other software · samanhappy · reported by VulDBLow 2
A vulnerability was determined in samanhappy MCPHub up to 0.9.10. This affects an unknown part of the file src/controllers/serverController.ts of the component MCPRouter Service. This manipulation of the argument baseUrl causes server-side request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- MCPHub
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2025A vulnerability was determined in Frappe LMS 2.35.0.CVE-2025-11283 · Other software · Frappe · reported by VulDBLow 1.9
A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument Description can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. It is suggested to upgrade the affected component. The vendor was informed early about a total of four security issues and confirmed that those have been fixed. However, the release notes on GitHub do not mention them.
- Product
- LMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Oct 4, 2025A vulnerability was determined in Open Asset Import Library Assimp 6.0.2.CVE-2025-11274 · Other software · Open Asset Import Library · reported by VulDBLow 1.9
A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation causes allocation of resources. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
- Product
- Assimp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existeCVE-2025-54291 · Other software · Canonical · reported by security@ubuntu.comMedium 6.9
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2025Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without autheCVE-2025-54290 · Other software · Canonical · reported by security@ubuntu.comMedium 6.9
Information disclosure in image export API in Canonical LXD before 6.5 and 5.21.4 on Linux allows network attackers to determine project existence without authentication via crafted requests using wildcard fingerprints.
- Product
- LXD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2025A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0.CVE-2025-11139 · Other software · Bjskzy · reported by VulDBLow 2.1
A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Zhiyou ERP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2025A vulnerability was determined in Tenda CH22 1.0.0.1.CVE-2025-11117 · Network & remote access · Tenda · reported by VulDBHigh 7.4
A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formWrlExtraGet of the file /goform/GstDhcpSetSer. This manipulation of the argument dips causes buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CH22
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2025A vulnerability was determined in D-Link DIR-823X 250416.CVE-2025-11099 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was determined in D-Link DIR-823X 250416. The impacted element is the function uci_del of the file /goform/delete_prohibiting. This manipulation of the argument delvalue causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2025A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464.CVE-2025-11089 · Other software · kidaze · reported by VulDBMedium 5.5
A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This impacts an unknown function of the file /Profilers/PriProfile/COUNT3s4.php. Executing manipulation of the argument cbranch can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
- Product
- CourseSelectionSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2025A vulnerability was determined in westboy CicadasCMS 1.0.CVE-2025-11069 · Other software · westboy · reported by VulDBLow 1.9
A vulnerability was determined in westboy CicadasCMS 1.0. Affected by this issue is some unknown functionality of the file /system/org/save of the component Add Department Handler. This manipulation of the argument Name causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- CicadasCMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025A vulnerability was determined in Jinher OA 2.0.CVE-2025-11035 · Other software · Jinher · reported by VulDBLow 2.1
A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025A vulnerability was determined in givanz Vvveb up to 1.0.7.2.CVE-2025-11026 · Other software · givanz · reported by VulDBLow 2
A vulnerability was determined in givanz Vvveb up to 1.0.7.2. Affected by this vulnerability is an unknown functionality of the component Configuration File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Once again the project maintainer reacted very professional: "I accept the existence of these vulnerabilities. (...) I fixed the code to remove these vulnerabilities and will push the code to github and make a new release."
- Product
- Vvveb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 26, 2025A vulnerability was determined in BehaviorTree up to 4.7.0.CVE-2025-11012 · Other software · Behaviortree · reported by VulDBLow 1.9
A vulnerability was determined in BehaviorTree up to 4.7.0. This affects the function ParseScript of the file /src/script_parser.cpp of the component Diagnostic Message Handler. Executing manipulation of the argument error_msgs_buffer can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. This patch is called cb6c7514efa628adb8180b58b4c9ccdebbe096e3. A patch should be applied to remediate this issue.
- Product
- Behaviortree
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2025A vulnerability was determined in Open Babel up to 3.1.1.CVE-2025-11000 · Other software · Openbabel · reported by VulDBLow 1.9
A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized.
- Product
- Open Babel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.CVE-2025-10992 · Other software · roncoo · reported by VulDBMedium 5.5
A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40. Affected is an unknown function of the file /user/info/lookupList. Executing manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- roncoo-pay
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in YunaiV yudao-cloud up to 2025.09.CVE-2025-10987 · Other software · YunaiV · reported by VulDBLow 2.1
A vulnerability was determined in YunaiV yudao-cloud up to 2025.09. Affected by this issue is some unknown functionality of the file /crm/contact/transfer of the component HTTP Request Handler. This manipulation of the argument contactId causes improper authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The affected component should be upgraded. The vendor confirms: "The controllers check the relevant update permission and obtain the acting user ID from the authenticated server context. The services require CRM OWNER permission and call transferPermission, which explicitly rejects a caller who is neither the owner nor an authorized CRM administrator."
- Product
- yudao-cloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in JeecgBoot up to 3.8.2.CVE-2025-10976 · Other software · Jeecg · reported by VulDBLow 1.3
A vulnerability was determined in JeecgBoot up to 3.8.2. This issue affects some unknown processing of the file /api/getDepartUserList. Executing manipulation of the argument departId can lead to improper authorization. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is assessed as difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jeecg Boot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in Wavlink NU516U1 M16U1_V240425.CVE-2025-10961 · Other software · Wavlink · reported by VulDBMedium 5.1
A vulnerability was determined in Wavlink NU516U1 M16U1_V240425. This affects the function sub_4030C0 of the file /cgi-bin/wireless.cgi of the component Delete_Mac_list Page. Executing manipulation of the argument delete_list can lead to command injection. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- NU516U1
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743.CVE-2025-10950 · Other software · geyang · reported by VulDBLow 2.1
A vulnerability was determined in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected is the function log_handler of the file ml_logger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
- Product
- ml-logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2025A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1.CVE-2025-10941 · Other software · Topaz · reported by VulDBHigh 8.5
A vulnerability was determined in Topaz SERVCore Teller 2.14.0-RC2/2.14.1. Affected by this issue is some unknown functionality of the file SERVCoreTeller_2.0.40D.msi of the component Installer. Executing manipulation can lead to permission issues. The attack needs to be launched locally. You should upgrade the affected component. The vendor explains, that "this vulnerability was detected at the beginning of 2025, it was remediated because the latest published version of the installer no longer uses "nssm," which is responsible for this vulnerability".
- Product
- SERVCore Teller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comvuldb.com
Sep 23, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-10846 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was determined in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /module/ComponenteCurricular/edit. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarinagante.github.iokarinagante.github.io
Sep 22, 2025A vulnerability was determined in 1000projects Bookstore Management System 1.0.CVE-2025-10833 · Other software · 1000projects · reported by VulDBMedium 5.5
A vulnerability was determined in 1000projects Bookstore Management System 1.0. The impacted element is an unknown function of the file /login.php. This manipulation of the argument unm causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Bookstore Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025A vulnerability was determined in axboe fio up to 3.41.CVE-2025-10824 · Other software · axboe · reported by VulDBLow 1.9
A vulnerability was determined in axboe fio up to 3.41. This impacts the function __parse_jobs_ini of the file init.c. Executing manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized.
- Product
- fio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025A vulnerability was determined in D-Link DIR-823X 240126/240802/250416.CVE-2025-10814 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was determined in D-Link DIR-823X 240126/240802/250416. Affected by this vulnerability is an unknown functionality of the file /usr/sbin/goahead. This manipulation of the argument port causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2025A vulnerability was determined in CodeAstro Simple Pharmacy Management 1.0.CVE-2025-10780 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was determined in CodeAstro Simple Pharmacy Management 1.0. This affects an unknown function of the file /view.php. This manipulation of the argument bar_code causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- Simple Pharmacy Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeastro.comgithub.com
Sep 21, 2025A vulnerability was determined in jeecgboot JimuReport up to 2.1.2.CVE-2025-10771 · Other software · jeecgboot · reported by VulDBLow 2.1
A vulnerability was determined in jeecgboot JimuReport up to 2.1.2. Affected is an unknown function of the file /drag/onlDragDataSource/testConnection of the component DB2 JDBC Handler. Executing manipulation of the argument clientRerouteServerListJNDIName can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- JimuReport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2025A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab.CVE-2025-10763 · Other software · academico-sis · reported by VulDBLow 2.1
A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab. Affected by this issue is some unknown functionality of the file /edit-photo of the component Profile Picture Handler. This manipulation causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- academico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comvuldb.com
Sep 19, 2025A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android.CVE-2025-10721 · Other software · Webull · reported by VulDBLow 1.9
A vulnerability was determined in Webull Investing & Trading App 11.2.5.63 on Android. This vulnerability affects unknown code of the file AndroidManifest.xml. This manipulation causes improper export of android application components. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Investing & Trading App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025A vulnerability was determined in D-Link DIR-852 1.00CN B09.CVE-2025-10629 · Network & remote access · D-Link · reported by VulDBLow 2.1
A vulnerability was determined in D-Link DIR-852 1.00CN B09. This issue affects the function ssdpcgi_main of the file htodcs/cgibin of the component Simple Service Discovery Protocol Service. Executing manipulation of the argument ST can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- DIR-852
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2025A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464.CVE-2025-10597 · Other software · kidaze · reported by VulDBMedium 6.9
A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This vulnerability affects unknown code of the file /Profilers/PriProfile/COUNT2.php. This manipulation of the argument cname causes sql injection. The attack may be initiated remotely. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available.
- Product
- CourseSelectionSystem
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14.CVE-2025-10442 · Network & remote access · Tenda · reported by VulDBLow 2.1
A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
- Product
- AC9
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0.CVE-2025-10433 · Other software · 1Panel-dev · reported by VulDBLow 2.1
A vulnerability was determined in 1Panel-dev MaxKB up to 2.0.2/2.1.0. This issue affects some unknown processing of the file /admin/api/workspace/default/tool/debug. Executing manipulation of the argument code can lead to deserialization. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.1.1 is capable of addressing this issue. It is suggested to upgrade the affected component.
- Product
- MaxKB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2025A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0.CVE-2025-10424 · Other software · 1000projects · reported by VulDBMedium 5.5
A vulnerability was determined in 1000projects Online Student Project Report Submission and Evaluation System 1.0. The affected element is an unknown function of the file /admin/controller/faculty_controller.php. This manipulation of the argument new_image causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- Online Student Project Report Submission and Evaluation System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2025A vulnerability was determined in codesiddhant Jasmin Ransomware up to 1.0.1.CVE-2025-10387 · Other software · codesiddhant · reported by VulDBLow 2.1
A vulnerability was determined in codesiddhant Jasmin Ransomware up to 1.0.1. This vulnerability affects unknown code of the file /handshake.php. This manipulation of the argument machine_name/computer_user/os/date/time/ip/location/systemid/password causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Jasmin Ransomware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2025A vulnerability was determined in MiczFlor RPi-Jukebox-RFID up to 2.8.0.CVE-2025-10369 · Other software · MiczFlor · reported by VulDBLow 2
A vulnerability was determined in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This affects an unknown part of the file /htdocs/cardRegisterNew.php. Executing manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- RPi-Jukebox-RFID
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025A vulnerability was determined in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3.CVE-2025-10340 · Other software · WhatCD · reported by VulDBLow 2
A vulnerability was determined in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3. The affected element is an unknown function of the file /sections/tools/managers/change_log.php of the component Commit Message Handler. Executing manipulation of the argument Message can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
- Product
- Gazelle
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2025A vulnerability was determined in Wavlink WL-WN578W2 221110.CVE-2025-10324 · Other software · Wavlink · reported by VulDBMedium 5.5
A vulnerability was determined in Wavlink WL-WN578W2 221110. This affects the function sub_401C5C of the file firewall.cgi. This manipulation of the argument pingFrmWANFilterEnabled/blockSynFloodEnabled/blockPortScanEnabled/remoteManagementEnabled causes command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WL-WN578W2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025A vulnerability was determined in erjinzhi 10OA 1.0.CVE-2025-10272 · Other software · erjinzhi · reported by VulDBLow 2.1
A vulnerability was determined in erjinzhi 10OA 1.0. Affected is an unknown function of the file /trial/mvc/catalogue. This manipulation of the argument Name causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- 10OA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2025A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0.CVE-2025-10255 · Other software · Ascensio System SIA · reported by VulDBLow 2
A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of the component Comment Handler. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and replied: "We are already working on this case, and the issues will be resolved in one of the upcoming patches."
- Product
- OnlyOffice
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 9, 2025A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing atCVE-2025-59015 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aMedium 6.3
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.
- Product
- TYPO3 CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025A vulnerability was determined in D-Link DIR-823X up to 250416.CVE-2025-10123 · Network & remote access · D-Link · reported by VulDBMedium 5.5
A vulnerability was determined in D-Link DIR-823X up to 250416. Affected by this vulnerability is the function sub_415028 of the file /goform/set_static_leases. Executing manipulation of the argument Hostname can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- DIR-823X
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025A vulnerability was determined in SiempreCMS up to 1.3.6.CVE-2025-10115 · Other software · reported by VulDBMedium 5.5
A vulnerability was determined in SiempreCMS up to 1.3.6. This affects an unknown part of the file user_search_ajax.php. This manipulation of the argument name/userName causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2025A vulnerability was determined in SimStudioAI sim up to 1.0.0.CVE-2025-10096 · Other software · SimStudioAI · reported by VulDBLow 2.1
A vulnerability was determined in SimStudioAI sim up to 1.0.0. This affects an unknown function of the file apps/sim/app/api/files/parse/route.ts. Executing manipulation of the argument filePath can lead to server-side request forgery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 3424a338b763115f0269b209e777608e4cd31785. Applying a patch is advised to resolve this issue.
- Product
- sim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2025A vulnerability was determined in Portabilis i-Educar up to 2.10.CVE-2025-10073 · Other software · Portabilis · reported by VulDBLow 2.1
A vulnerability was determined in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/Api/turma. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- i-Educar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.CVE-2025-30200 · Other software · ECOVACS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Low 2.3
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic AES encryption key, which can be easily derived.
- Product
- DEEBOT X1 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.CVE-2025-30198 · Other software · ECOVACS · reported by 9119a7d8-5eab-497f-8521-727c672e3725Low 2.3
ECOVACS robot vacuums and base stations communicate via an insecure Wi-Fi network with a deterministic WPA2-PSK, which can be easily derived.
- Product
- DEEBOT X1 Series
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2025In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent.CVE-2025-32347 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onStart of BiometricEnrollIntroduction.java, there is a possible way to determine the device's location due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Sep 4, 2025A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506.CVE-2025-9935 · Other software · TOTOLINK · reported by VulDBMedium 5.5
A vulnerability was determined in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function sub_4159F8 of the file /web_cste/cgi-bin/cstecgi.cgi. Executing manipulation can lead to command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
- Product
- N600R
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.