Skip to content
OpenAdvisories

Archive

17 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /17 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.5
    CVE-2025-59342 Public exploit Scanner template

    esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header

    esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage locati…

    esm-dev esm.sh github.com/esm-dev/esm.sh Go
  • Medium 6.5
    CVE-2025-9215 Public exploit

    StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download

    The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.0 via the file_download() function. This makes it possible…

    kodezen StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More Web / CMS
  • Medium 5.9
    CVE-2025-10042 Public exploit

    Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection

    The Quiz Maker plugin for WordPress is vulnerable to SQL Injection via spoofed IP headers in all versions up to, and including, 6.7.0.56 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. …

    Ays Pro Quiz Maker Web / CMS
  • Medium 6.5
    CVE-2025-57055 Public exploit

    WonderCMS 3.5.0 is vulnerable to Server-Side Request Forgery (SSRF) in the custom module installation functionality. An…