Skip to content
OpenAdvisories

Archive

8 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /8 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 9.1
    CVE-2025-58746

    Volkov Labs Business Links plugin vulnerable to privilege escalation attack

    The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to A…

    VolkovLabs business-links
  • Critical 10.0
    CVE-2025-58745

    WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)

    WeGIA is a Web manager for charitable institutions. The fix for CVE-2025-22133 was not enough to remediate the arbitrary file upload vulnerability. The WeGIA only check MIME types for Excel files at endpoint `/html/socio/sistema/controller/controla_xlsx.php`,…

    LabRedesCefetRJ WeGIA
  • Critical 9.3
    CVE-2025-58450

    pREST has Systemic SQL Injection Vulnerability

    pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible in versions prior to 2.0.0-rc3. The validation present in versions prior to 2.0.0-rc3 does not provide adequate protection from injection …

    prest prest github.com/prest/prest github.com/prest/prest/v2 Go
  • Critical 9.3
    CVE-2025-54994

    @akoskm/create-mcp-server-stdio has Command Injection in MCP Server due to unsafe `exec` API

    @akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool d…

    akoskm create-mcp-server-stdio @akoskm/create-mcp-server-stdio npm
  • Critical 9.8
    CVE-2025-9114

    Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change

    The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. Th…

    dreamstechnologies Doccure Web / CMS
  • Critical 9.8
    CVE-2025-9113

    Doccure Core <= 1.5.3 - Unauthenticated Arbitrary File Upload

    The Doccure Core plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'doccure_temp_upload_to_media' function in all versions up to, and including, 1.5.3. This makes it possible for unauthenticated attackers …

    dreamstechnologies Doccure Core Web / CMS
  • Critical 9.2
    CVE-2025-5993

    Path Traversal in ITCube CRM

    ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is able to exploit vulnerable parameter fileName and construct payloads that allow to download any file accessible by the the web server process.

    ITCube Software ITCube CRM
  • Critical 9.8
    CVE-2025-57285

    CodeceptJS's incomprehensive sanitation can lead to Command Injection

    codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbi…

    codeceptjs npm
  • Critical 9.8
    CVE-2025-57141

    rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.

  • Critical 9.8
    CVE-2025-52161

    Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) v…

  • Critical 9.8
    CVE-2025-22956

    OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead…

  • Critical 9.8
    CVE-2025-56267

    A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbit…

  • Critical 9.8
    CVE-2025-56266 Scanner template

    A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplyi…