Vulnerability Summary for the ... Note

Vulnerability Summary for the Week of September 8, 2025

This report details numerous high-severity vulnerabilities affecting various software products. Adobe products are heavily impacted, with Acrobat Reader, Adobe Commerce, and ColdFusion all susceptible to vulnerabilities leading to code execution or session takeover. Adobe Experience Manager has a security feature bypass, while Dreamweaver and Premiere Pro also face code execution risks. Multiple vulnerabilities are identified in Adobe's Substance3D Modeler and Viewer applications, primarily related to memory corruption and leading to code execution. AMI's AptioV BIOS contains vulnerabilities allowing information disclosure and data writing. WordPress plugins like LWS Cleaner and Goza are vulnerable to arbitrary file deletion, potentially leading to remote code execution. The Axios JavaScript library has a denial-of-service vulnerability when handling data URIs. AxxonSoft's Axxon One VMS is affected by multiple issues, including exploitation of unmaintained third-party components and vulnerable PostgreSQL versions, posing risks of code execution and privilege escalation. Baicells network devices exhibit severe vulnerabilities like default credentials, hard-coded credentials, and undocumented features, with some rated at CVSS 10. Beckhoff's TwinCAT 3 Engineering has a vulnerability allowing command execution via manipulated project files. Bender CC612 devices expose credentials and transmit sensitive data insecurely. BeyondCart Connector for WordPress allows privilege escalation through JWT misconfigurations. Several Campcodes systems, including Grocery Sales and Inventory System and Online Loan Management System, are vulnerable to SQL injection in their AJAX endpoints.