NVD disclosure day

Published threat advisories for September 10, 2025

CVE advisoryCRITICAL

CVE-2025-10220

Axxon One VMS Unmaintained Components Code Execution Vulnerability

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

A critical vulnerability exists in Axxon One video management software due to unmaintained third-party components, allowing remote attackers to execute arbitrary code or bypass security controls. Addressing this is crucial for maintaining system security.

NVD modified: NVD date unavailable
CVE advisoryCRITICAL

CVE-2025-9943

Shibboleth SP SQL Injection via SAML ID Attribute

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

An SQL injection vulnerability in the Shibboleth Service Provider allows unauthenticated attackers to extract arbitrary data from SQL databases used for replay caching with the ODBC plugin. This occurs via blind SQL injection in the SAML response's "ID" attribute, potentially exposing sensitive information if the datab

NVD modified: NVD date unavailable