Skip to content
OpenAdvisories

Archive

30 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /30 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

53 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-55797

    FormCMS has an improper access control vulnerability in the /api/schemas/history/[schemaId] endpoint

    An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauthenticated attackers to access historical schema data if a valid schemaId is known or guessed.

    FormCMS NuGet
  • Medium 4.8
    CVE-2025-28016

    A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User R…

  • Medium 6.4
    CVE-2025-61792

    Quadient DS-700 iQ devices through 2025-09-30 might have a race condition during the quick clicking of (in order) the Q…

    Quadient DS-700 iQ
  • Medium 6.5
    CVE-2025-57254

    An SQL injection vulnerability in user-login.php and index.php of Karthikg1908 Hospital Management System (HMS) 1.0 all…

  • Medium 6.5
    CVE-2025-52047

    In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL In…

  • Medium 6.5
    CVE-2025-52049

    In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py…

  • Medium 6.5
    CVE-2025-52050

    In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_p…

  • Medium 6.5
    CVE-2025-52043

    In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_a…

  • Medium 6.1
    CVE-2025-56200

    validator.js has a URL validation bypass vulnerability in its isURL function

    A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and …

    sqlpad saf validator validator.js Ubuntu Wolfi npm
  • Medium 5.4
    CVE-2025-56676

    TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary …

  • Medium 6.5
    CVE-2025-56207

    A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an E…

  • Medium 6.1
    CVE-2025-56018

    SourceCodester Web-based Pharmacy Product Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in Categor…

  • Medium 5.3
    CVE-2025-56520 Scanner template

    Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote…