Skip to content
OpenAdvisories

Archive

3 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /3 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 7.3
    CVE-2025-9933 Public exploit

    PHPGurukul Beauty Parlour Management System view-appointment.php sql injection

    A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. Affected by this issue is some unknown functionality of the file /admin/view-appointment.php. Such manipulation of the argument viewid leads to sql injection. The attack may be…

    PHPGurukul Beauty Parlour Management System
  • Critical 9.0
    CVE-2025-53690 Exploited Public exploit EPSS 61%

    Sitecore Products ViewState Deserialization Vulnerability

    Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection.This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

    Sitecore Experience Platform (XP) Experience Manager (XM)
    KEV Sep 4, 2025
  • High 7.8
    CVE-2025-38678 Public exploit

    netfilter: nf_tables: reject duplicate device on updates

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the firs…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 8.8
    CVE-2025-53691 Public exploit

    Sitecore Experience Remote Code Execution through Insecure Deserialization

    Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Plat…

    Sitecore Experience Platform (XP) Experience Manager (XM)
  • Critical 9.8
    CVE-2025-53693 Public exploit EPSS 20%

    HTML Cache Poisoning through Unsafe Reflections

    Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9…

    Sitecore Experience Platform (XP) Sitecore Experience Manager (XM)
  • High 7.5
    CVE-2025-53694 Public exploit

    Information Disclosure in ItemServices API

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from…

    Sitecore Experience Platform (XP) Sitecore Experience Manager (XM)
  • Critical 9.8
    CVE-2024-32444 Public exploit

    WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.3.6.

    InspiryThemes RealHomes
  • High 7.6
    CVE-2025-45805 Public exploit

    In phpgurukul Doctor Appointment Management System 1.0, an authenticated doctor user can inject arbitrary JavaScript co…

  • Critical 9.8
    CVE-2025-57052 Public exploit

    cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.…

    cjson cjson cjson Debian Ubuntu Alpine
  • High 7.1
    CVE-2025-57833 Public exploit EPSS 28%

    Django is subject to SQL injection through its column aliases

    An issue was discovered in Django 4.2 before 4.2.24, 5.1 before 5.1.12, and 5.2 before 5.2.6. FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annot…

    djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  • High 8.4
    CVE-2025-56803 Public exploit

    Figma Desktop for Windows version 125.6.5 contains a command injection vulnerability in the local plugin loader. An att…

  • Medium 4.2
    CVE-2025-56608 Public exploit

    The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHt…