Skip to content
OpenAdvisories

Archive

29 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /29 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

59 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-10345

    HTML injection in Perfex CRM

    HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'address' at the endpoint 'admin/leads/lead'.

    Perfex CRM Perfex CRM
  • Medium 5.3
    CVE-2025-10344

    HTML injection in Perfex CRM

    HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameters 'name' and 'clientid' at the endpoint '/projects/project/x'.

    Perfex CRM Perfex CRM
  • Medium 5.3
    CVE-2025-10343

    HTML injection in Perfex CRM

    HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'expense_name' at the endpoint '/expenses/expense'.

    Perfex CRM Perfex CRM
  • Medium 5.3
    CVE-2025-10342

    HTML injection in Perfex CRM

    HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'name' at the endpoint '/subscriptions/create'.

    Perfex CRM Perfex CRM
  • Medium 5.3
    CVE-2025-10341

    HTML injection in Perfex CRM

    HTML injection vulnerability in Perfex CRM v3.2.1 consisting of a stored HTML injection due to lack of proper validation of user input by sending a POST request in the parameter 'company' at the endpoint '/clients/client/x.

    Perfex CRM Perfex CRM
  • Medium 4.8
    CVE-2024-5200

    Postie < 1.9.71 - Admin+ Stored XSS

    The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exampl…

    Web / CMS
  • Medium 4.7
    CVE-2025-11141

    Ruijie NBR2100G-E branch_passw.php listAction os command injection

    A security flaw has been discovered in Ruijie NBR2100G-E up to 20250919. Affected by this issue is the function listAction of the file /itbox_pi/branch_passw.php?a=list. Performing manipulation of the argument city results in os command injection. The attack …

    Ruijie NBR2100G-E
  • Medium 6.1
    CVE-2025-10504

    Heap Memory Corruption Vulnerability

    Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.

    ABB Terra AC wallbox ICS / OT
  • Medium 6.3
    CVE-2025-11139

    Bjskzy Zhiyou ERP com.artery.form.services.FormStudioUpdater uploadStudioFile path traversal

    A vulnerability was determined in Bjskzy Zhiyou ERP up to 11.0. Affected is the function uploadStudioFile of the component com.artery.form.services.FormStudioUpdater. This manipulation of the argument filepath causes path traversal. Remote exploitation of the…

    Bjskzy Zhiyou ERP
  • Medium 6.3
    CVE-2025-11138

    mirweiye wenkucms common.php createPathOne os command injection

    A vulnerability was found in mirweiye wenkucms up to 3.4. This impacts the function createPathOne of the file app/common/common.php. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been made public and co…

    mirweiye wenkucms
  • Medium 4.7
    CVE-2025-11136

    YiFang CMS Backend File.php webUploader unrestricted upload

    A flaw has been found in YiFang CMS up to 2.0.2. The impacted element is the function webUploader of the file app/app/controller/File.php of the component Backend. Executing manipulation of the argument uploadpath can lead to unrestricted upload. The attack c…

    YiFang CMS
  • Medium 5.9
    CVE-2025-7698

    Out-of-bounds read vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printe…

    Canon UFR II Printer Driver Generic Plus LIPSLX Printer Driver PCL6 Printer Driver
  • Medium 5.3
    CVE-2025-9904

    Unallocated memory access vulnerability in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II P…

    Canon Generic Plus PCL6 Printer Driver LIPSLX Printer Driver Generic Plus LIPS4 Printer Driver
  • Medium 5.9
    CVE-2025-9903

    Out-of-bounds write vulnerabilities in print processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Print…

    Canon Generic Plus LIPS4 Printer Driver PS Printer Driver Generic Plus PS Printer Driver
  • Medium 6.8
    CVE-2025-61659

    bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp/git-index-private$$ file, which has a predictable name.

    magicmonty bash-git-prompt
  • Medium 6.0
    CVE-2025-57197

    In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for…

  • Medium 6.5
    CVE-2025-57428 Public exploit

    Default credentials in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to gai…

  • Medium 6.1
    CVE-2025-56807 Public exploit

    A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administra…

  • Medium 5.3
    CVE-2025-56764 Public exploit

    Trivision NC-227WF firmware 5.80 (build 20141010) login mechanism reveals whether a username exists or not by returning…