IT-Sentinel

> CVE-2025-53809 [MEDIUM 6.5]

[PUBLISHED: 2025-09-09] [EPSS 1.57%]

Improper input validation in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.

AFFECTED_PRODUCTS: Microsoft Windows 11 24h2, Microsoft Windows Server 2025

> CVE-2025-53808 [MEDIUM 6.7]

[PUBLISHED: 2025-09-09] [EPSS 0.48%]

Access of resource using incompatible type ('type confusion') in Windows Defender Firewall Service allows an authorized attacker to elevate privileges locally.

AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+15)

> CVE-2025-53807 [HIGH 7.0]

[PUBLISHED: 2025-09-09] [EPSS 0.29%]

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

AFFECTED_PRODUCTS: Microsoft Windows Server 2019, Microsoft Windows Server 2022, Microsoft Windows 10 1809 ... (+7)

> CVE-2025-53806 [MEDIUM 6.5]

[PUBLISHED: 2025-09-09] [EPSS 1.20%]

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+4)

> CVE-2025-53805 [HIGH 7.5]

[PUBLISHED: 2025-09-09] [EPSS 1.51%]

Out-of-bounds read in Windows Internet Information Services allows an unauthorized attacker to deny service over a network.

AFFECTED_PRODUCTS: Microsoft Windows Server 2022, Microsoft Windows 11 22h2, Microsoft Windows 11 23h2 ... (+3)

> CVE-2025-53804 [MEDIUM 5.5]

[PUBLISHED: 2025-09-09] [EPSS 0.66%]

Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally.

AFFECTED_PRODUCTS: Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019 ... (+14)

> CVE-2025-53803 [MEDIUM 5.5]

[PUBLISHED: 2025-09-09] [EPSS 0.66%]

Generation of error message containing sensitive information in Windows Kernel allows an authorized attacker to disclose information locally.

AFFECTED_PRODUCTS: Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019 ... (+14)

> CVE-2025-53802 [HIGH 7.0]

[PUBLISHED: 2025-09-09] [EPSS 0.38%]

Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.

AFFECTED_PRODUCTS: Microsoft Windows Server 2022, Microsoft Windows 10 21h2, Microsoft Windows 10 22h2 ... (+5)

> CVE-2025-53801 [HIGH 7.8]

[PUBLISHED: 2025-09-09] [EPSS 0.45%]

Untrusted pointer dereference in Windows DWM allows an authorized attacker to elevate privileges locally.

AFFECTED_PRODUCTS: Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows 10 1507 ... (+8)

> CVE-2025-53800 [HIGH 7.8]

[PUBLISHED: 2025-09-09] [EPSS 0.50%]

No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

AFFECTED_PRODUCTS: Microsoft Windows Server 2016, Microsoft Windows Server 2019, Microsoft Windows 10 1607 ... (+9)

> CVE-2025-53799 [MEDIUM 5.5]

[PUBLISHED: 2025-09-09] [EPSS 0.84%]

Use of uninitialized resource in Windows Imaging Component allows an unauthorized attacker to disclose information locally.

AFFECTED_PRODUCTS: Microsoft Office, Microsoft Windows Server 2008, Microsoft Windows Server 2012 ... (+16)

> CVE-2025-53798 [MEDIUM 6.5]

[PUBLISHED: 2025-09-09] [EPSS 1.20%]

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+4)

> CVE-2025-53797 [MEDIUM 6.5]

[PUBLISHED: 2025-09-09] [EPSS 1.20%]

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+4)

> CVE-2025-53796 [MEDIUM 6.5]

[PUBLISHED: 2025-09-09] [EPSS 1.20%]

Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

AFFECTED_PRODUCTS: Microsoft Windows Server 2008, Microsoft Windows Server 2012, Microsoft Windows Server 2016 ... (+4)

> CVE-2025-53348 [MEDIUM 5.3]

[PUBLISHED: 2025-09-09] [EPSS 0.27%]

Missing Authorization vulnerability in Laborator Kalium. This issue affects Kalium: from n/a through 3.18.3.

> CVE-2025-53340 [MEDIUM 5.3]

[PUBLISHED: 2025-09-09] [EPSS 0.29%]

Missing Authorization vulnerability in awesomesupport Awesome Support. This issue affects Awesome Support: from n/a through 6.3.4.

> CVE-2025-53303 [HIGH 8.8]

[PUBLISHED: 2025-09-09] [EPSS 0.38%]

Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core allows Object Injection. This issue affects ThemeMove Core: from n/a through 1.4.2.

> CVE-2025-53291 [MEDIUM 5.4]

[PUBLISHED: 2025-09-09] [EPSS 0.27%]

Missing Authorization vulnerability in spoddev2021 Spreadconnect. This issue affects Spreadconnect: from n/a through 2.1.5.

> CVE-2025-49860 [MEDIUM 5.3]

[PUBLISHED: 2025-09-09] [EPSS 0.29%]

Missing Authorization vulnerability in Majestic Support Majestic Support. This issue affects Majestic Support: from n/a through 1.1.0.

> CVE-2025-49734 [HIGH 7.0]

[PUBLISHED: 2025-09-09] [EPSS 0.33%]

Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.

AFFECTED_PRODUCTS: Microsoft Windows Server 2016, Microsoft Powershell, Microsoft Powershell ... (+11)

> CVE-2025-49692 [HIGH 7.8]

[PUBLISHED: 2025-09-09] [EPSS 0.35%]

Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.

AFFECTED_PRODUCTS: Microsoft Azure Connected Machine Agent

> CVE-2025-49430 [HIGH 7.2]

[PUBLISHED: 2025-09-09] [EPSS 0.25%]

Server-Side Request Forgery (SSRF) vulnerability in FWDesign Ultimate Video Player allows Server Side Request Forgery. This issue affects Ultimate Video Player: from n/a through 10.1.

> CVE-2025-48101 [HIGH 8.8]

[PUBLISHED: 2025-09-09] [EPSS 0.33%]

Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.

> CVE-2025-47997 [MEDIUM 6.5]

[PUBLISHED: 2025-09-09] [EPSS 0.87%]

Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to disclose information over a network.

AFFECTED_PRODUCTS: Microsoft Sql Server 2019, Microsoft Sql Server 2019, Microsoft Sql Server 2022 ... (+5)

> CVE-2025-47695 [HIGH 7.5]

[PUBLISHED: 2025-09-09] [EPSS 0.64%]

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO. This issue affects Blog Designer PRO: from n/a through 3.4.7.

> CVE-2025-47694 [HIGH 7.1]

[PUBLISHED: 2025-09-09] [EPSS 0.23%]

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO. This issue affects Blog Designer PRO: from n/a through 3.4.7.

> CVE-2025-47579 [CRITICAL 9.0]

[PUBLISHED: 2025-09-09] [EPSS 0.33%]

Deserialization of Untrusted Data vulnerability in ThemeGoods Photography. This issue affects Photography: from n/a through 7.5.2.

> CVE-2025-47571 [HIGH 7.5]

[PUBLISHED: 2025-09-09] [EPSS 0.58%]

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in highwarden Super Store Finder. This issue affects Super Store Finder: from n/a through 6.9.7.

> CVE-2025-47570 [HIGH 7.1]

[PUBLISHED: 2025-09-09] [EPSS 0.24%]

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews. This issue affects WooCommerce Photo Reviews: from n/a through 1.3.13.

> CVE-2025-47569 [CRITICAL 9.3]

[PUBLISHED: 2025-09-09] [EPSS 0.62%]

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommerce Ultimate Gift Card - Create, Sell and Manage Gift Cards with Customized Email Templates. This issue affects WooCommerce Ultimate Gift Card - Create, Sell and Manage Gift Cards w...

> CVE-2025-47437 [MEDIUM 6.4]

[PUBLISHED: 2025-09-09] [EPSS 0.26%]

Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache. This issue affects LiteSpeed Cache: from n/a through 7.0.1.

> CVE-2025-39553 [MEDIUM 4.3]

[PUBLISHED: 2025-09-09] [EPSS 0.26%]

Missing Authorization vulnerability in andy_moyle Church Admin. This issue affects Church Admin: from n/a through 5.0.9.

> CVE-2025-39541 [MEDIUM 6.5]

[PUBLISHED: 2025-09-09] [EPSS 0.32%]

Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar. This issue affects WP Simple Booking Calendar: from n/a through 2.0.13.

> CVE-2025-39523 [MEDIUM 4.7]

[PUBLISHED: 2025-09-09] [EPSS 0.26%]

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber. This issue affects GoodBarber: from n/a through 1.0.26.

> CVE-2025-32689 [HIGH 7.5]

[PUBLISHED: 2025-09-09] [EPSS 0.33%]

Improper Validation of Specified Quantity in Input vulnerability in ThemesGrove WP SmartPay. This issue affects WP SmartPay: from n/a through 2.7.13.

> CVE-2025-32688 [MEDIUM 5.4]

[PUBLISHED: 2025-09-09] [EPSS 0.22%]

Missing Authorization vulnerability in Sovica Target Video Easy Publish. This issue affects Target Video Easy Publish: from n/a through 3.8.8.

> CVE-2025-32486 [CRITICAL 9.8]

[PUBLISHED: 2025-09-09] [EPSS 0.34%]

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard. This issue affects Material Dashboard: from n/a through 1.4.6.

> CVE-2025-30875 [MEDIUM 5.9]

[PUBLISHED: 2025-09-09] [EPSS 0.22%]

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandre Froger WP Weixin allows Stored XSS. This issue affects WP Weixin: from n/a through 1.3.16.

> CVE-2025-9872 [HIGH 8.8]

[PUBLISHED: 2025-09-09] [⚡ EPSS 16.7%]

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.

AFFECTED_PRODUCTS: Ivanti Endpoint Manager, Ivanti Endpoint Manager, Ivanti Endpoint Manager

> CVE-2025-9712 [HIGH 8.8]

[PUBLISHED: 2025-09-09] [⚡ EPSS 23.9%]

Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. User interaction is required.

AFFECTED_PRODUCTS: Ivanti Endpoint Manager, Ivanti Endpoint Manager, Ivanti Endpoint Manager

> CVE-2025-8712 [MEDIUM 5.4]

[PUBLISHED: 2025-09-09] [EPSS 0.45%]

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privil...