Skip to content
OpenAdvisories

Archive

September 2025

Vulnerabilities first published in this month (UTC), newest first.

← August 2025 2025 / September October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

2,069 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-54095

    Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

    Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows
  • Medium 6.5
    CVE-2025-53798

    Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

    Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows
  • Medium 6.5
    CVE-2025-53797

    Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability

    Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows
  • Medium 4.9
    CVE-2025-54250

    Adobe Experience Manager | Improper Input Validation (CWE-20)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain…

    Adobe Adobe Experience Manager
  • Medium 6.5
    CVE-2025-54246

    Adobe Experience Manager | Incorrect Authorization (CWE-863)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain un…

    Adobe Adobe Experience Manager
  • Medium 6.5
    CVE-2025-54247

    Adobe Experience Manager | Improper Input Validation (CWE-20)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain …

    Adobe Adobe Experience Manager
  • Medium 4.3
    CVE-2025-54251 Scanner template

    Adobe Experience Manager | XML Injection (aka Blind XPath Injection) (CWE-91)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an XML Injection vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate XML queries and gain limited unauth…

    Adobe Adobe Experience Manager
  • Medium 5.4
    CVE-2025-54252

    Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. This could result in bypassing …

    Adobe Adobe Experience Manager
  • Medium 6.5
    CVE-2025-54249 Scanner template

    Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918)

    Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to manipulate server-side req…

    Adobe Adobe Experience Manager
  • Medium 4.3
    CVE-2025-58976

    WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from …

    Equalize Digital Accessibility Checker by Equalize Digital
  • Medium 4.3
    CVE-2025-58975

    WordPress Advanced Settings Plugin <= 3.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanced Settings: from n/a through <= 3.1.1.

    Helmut Wandl Advanced Settings
  • Medium 4.9
    CVE-2025-58977

    WordPress WP eBay Product Feeds Plugin <= 3.4.8 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Server Side Request Forgery.This issue affects WP eBay Product Feeds: from n/a through <= 3.4.8.

    Rhys Wynne WP eBay Product Feeds
  • Medium 5.3
    CVE-2025-58978

    WordPress PDF Generator for WordPress Plugin <= 1.5.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF Generator for WordPress: from n/a through <= 1.5.4.

    WP Swings PDF Generator for WordPress Web / CMS
  • Medium 5.3
    CVE-2025-58979

    WordPress BerqWP Plugin <= 2.2.53 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in BerqWP BerqWP searchpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BerqWP: from n/a through <= 2.2.53.

    BerqWP BerqWP
  • Medium 5.4
    CVE-2025-58981

    WordPress Accessibility Checker by Equalize Digital Plugin <= 1.31.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Equalize Digital Accessibility Checker by Equalize Digital accessibility-checker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accessibility Checker by Equalize Digital: from …

    Equalize Digital Accessibility Checker by Equalize Digital
  • Medium 5.3
    CVE-2025-58980

    WordPress Export WP Page to Static HTML/CSS Plugin <= 4.1.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in recorp Export WP Page to Static HTML/CSS export-wp-page-to-static-html allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export WP Page to Static HTML/CSS: from n/a through <= 4.1.0.

    Recorp Export WP Page to Static HTML/CSS
  • Medium 5.9
    CVE-2025-58982

    WordPress Pixeline's Email Protector Plugin <= 1.3.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline Pixeline's Email Protector pixelines-email-protector allows Stored XSS.This issue affects Pixeline's Email Protector: from n/a through <= 1.3.8.

    pixeline Pixeline's Email Protector
  • Medium 5.9
    CVE-2025-58984

    WordPress Welcart e-Commerce Plugin <= 2.11.20 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.20.

    info@welcart Welcart e-Commerce
  • Medium 5.9
    CVE-2025-58983

    WordPress Include Me Plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stefano Lissa Include Me include-me allows Stored XSS.This issue affects Include Me: from n/a through <= 1.3.2.

    Stefano Lissa Include Me
  • Medium 6.5
    CVE-2025-58985

    WordPress Additional Custom Product Tabs for WooCommerce Plugin <= 1.7.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Additional Custom Product Tabs for WooCommerce product-tabs-for-woocommerce allows Stored XSS.This issue affects Additional Custom Product Tabs for…

    WPFactory Additional Custom Product Tabs for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-58987

    WordPress Football Pool Plugin <= 2.12.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.6.

    antoineh Football Pool
  • Medium 6.5
    CVE-2025-58988

    WordPress My Tickets Plugin <= 2.0.22 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson My Tickets my-tickets allows Stored XSS.This issue affects My Tickets: from n/a through <= 2.0.22.

    Joe Dolson My Tickets
  • Medium 6.5
    CVE-2025-58989

    WordPress Dynamic Text Field For Contact Form 7 Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dynamic-text-field-for-contact-form-7 allows Stored XSS.This issue affects Dynamic Text Field For Cont…

    silverplugins217 Dynamic Text Field For Contact Form 7
  • Medium 6.5
    CVE-2025-58990

    WordPress ShopLentor Plugin <= 3.2.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevItems ShopLentor woolentor-addons allows Stored XSS.This issue affects ShopLentor: from n/a through <= 3.2.0.

    DevItems ShopLentor
  • Medium 5.3
    CVE-2025-5500

    ZhenShi Mibro Fit App com.xiaoxun.xunoversea.mibrofit AndroidManifest.xml improper export of android application components

    A flaw has been found in ZhenShi Mibro Fit App 1.6.3.17499 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.xiaoxun.xunoversea.mibrofit. This manipulation causes improper export of android application component…

    ZhenShi Mibro Fit App
  • Medium 5.9
    CVE-2025-30875

    WordPress WP Weixin plugin <= 1.3.16 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandre Froger WP Weixin wp-weixin allows Stored XSS.This issue affects WP Weixin: from n/a through <= 1.3.16.

    Alexandre Froger WP Weixin
  • Medium 5.3
    CVE-2025-53340

    WordPress Awesome Support plugin <= 6.3.6 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Support: from n/a through <= 6.3.6.

    Awesome Support Awesome Support
  • Medium 5.4
    CVE-2025-53291

    WordPress Spreadconnect plugin <= 2.1.5 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5.

    spoddev2021 Spreadconnect
  • Medium 5.3
    CVE-2025-53348

    WordPress Kalium Theme <= 3.18.3 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalium: from n/a through <= 3.18.3.

    Laborator Kalium
  • Medium 5.4
    CVE-2025-32688

    WordPress Target Video Easy Publish plugin <= 3.8.9 - Arbitrary Code Execution vulnerability

    Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through <= 3.8.9.

    Nebojsa Target Video Easy Publish
  • Medium 4.7
    CVE-2025-39523

    WordPress GoodBarber plugin <= 1.0.26 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber goodbarber.This issue affects GoodBarber: from n/a through <= 1.0.26.

    GoodBarber GoodBarber
  • Medium 6.5
    CVE-2025-39541

    WordPress WP Simple Booking Calendar plugin <= 2.0.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar wp-simple-booking-calendar.This issue affects WP Simple Booking Calendar: from n/a through <= 2.0.13.

    Roland Murg WP Simple Booking Calendar
  • Medium 4.3
    CVE-2025-39553

    WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9.

    andy_moyle Church Admin
  • Medium 6.4
    CVE-2025-47437

    WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 7.0.1.

    LiteSpeed Technologies LiteSpeed Cache
  • Medium 5.3
    CVE-2025-49860

    WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.

    Majestic Support Majestic Support
  • Medium 4.3
    CVE-2025-59005

    WordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in frenify Categorify categorify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Categorify: from n/a through <= 1.0.7.5.

    Frenify Categorify
  • Medium 5.4
    CVE-2025-55144

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • Medium 6.1
    CVE-2025-55143

    Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivan…

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • Medium 6.8
    CVE-2025-55139

    SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • Medium 4.9
    CVE-2025-55146

    An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Iva…

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices