# CVEs published 2025-07-27

41 CVEs were published on July 27, 2025: 0 critical, 8 high. Days are UTC.

- [CVE-2025-8247](https://cve.now/CVE-2025-8247.md): Projectworlds Online Admission System admin.php sql injection (CVSS 5.3, Projectworlds Online Admission System)
- [CVE-2025-8246](https://cve.now/CVE-2025-8246.md): TOTOLINK X15 HTTP POST Request formRoute buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-8245](https://cve.now/CVE-2025-8245.md): TOTOLINK X15 HTTP POST Request formMultiAPVLAN buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-8244](https://cve.now/CVE-2025-8244.md): TOTOLINK X15 HTTP POST Request formMapDelDevice buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-8243](https://cve.now/CVE-2025-8243.md): TOTOLINK X15 HTTP POST Request formMapDel buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-8242](https://cve.now/CVE-2025-8242.md): TOTOLINK X15 HTTP POST Request formFilter buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-8241](https://cve.now/CVE-2025-8241.md): 1000 Projects ABC Courier Management System report.php sql injection (CVSS 6.9, 1000 Projects ABC Courier Management System)
- [CVE-2025-8240](https://cve.now/CVE-2025-8240.md): code-projects Exam Form Submission dashboard.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8239](https://cve.now/CVE-2025-8239.md): code-projects Exam Form Submission admin sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8238](https://cve.now/CVE-2025-8238.md): code-projects Exam Form Submission update\_s2.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8237](https://cve.now/CVE-2025-8237.md): code-projects Exam Form Submission update\_s1.php sql injection (CVSS 6.9, code-projects Exam Form Submission)
- [CVE-2025-8236](https://cve.now/CVE-2025-8236.md): code-projects Online Ordering System edit\_product.php sql injection (CVSS 6.9, code-projects Online Ordering System)
- [CVE-2025-8235](https://cve.now/CVE-2025-8235.md): code-projects Online Ordering System product.php sql injection (CVSS 6.9, code-projects Online Ordering System)
- [CVE-2025-8234](https://cve.now/CVE-2025-8234.md): code-projects Online Ordering System delete\_member.php sql injection (CVSS 6.9, code-projects Online Ordering System)
- [CVE-2025-8233](https://cve.now/CVE-2025-8233.md): code-projects Online Ordering System user.php sql injection (CVSS 6.9, code-projects Online Ordering System)
- [CVE-2025-8232](https://cve.now/CVE-2025-8232.md): code-projects Online Ordering System delete\_user.php sql injection (CVSS 6.9, code-projects Online Ordering System)
- [CVE-2025-8231](https://cve.now/CVE-2025-8231.md): D-Link DIR-890L UART Port rgbin hard-coded credentials (CVSS 7.0, D-Link DIR-890L)
- [CVE-2025-8230](https://cve.now/CVE-2025-8230.md): Campcodes Courier Management System manage\_user.php sql injection (CVSS 5.3, Campcodes Courier Management System)
- [CVE-2025-8229](https://cve.now/CVE-2025-8229.md): Campcodes Courier Management System parcel\_list.php sql injection (CVSS 5.3, Campcodes Courier Management System)
- [CVE-2025-8228](https://cve.now/CVE-2025-8228.md): yanyutao0402 ChanCMS getPages server-side request forgery (CVSS 5.3, yanyutao0402 ChanCMS)
- [CVE-2025-8227](https://cve.now/CVE-2025-8227.md): yanyutao0402 ChanCMS getArticle deserialization (CVSS 5.3, yanyutao0402 ChanCMS)
- [CVE-2025-8226](https://cve.now/CVE-2025-8226.md): yanyutao0402 ChanCMS find information disclosure (CVSS 5.3, yanyutao0402 ChanCMS)
- [CVE-2025-8225](https://cve.now/CVE-2025-8225.md): GNU Binutils DWARF Section dwarf.c process\_debug\_info memory leak (CVSS 4.8, GNU Binutils)
- [CVE-2025-5120](https://cve.now/CVE-2025-5120.md): Sandbox Escape Vulnerability in huggingface/smolagents (CVSS 7.6, huggingface/smolagents · smolagents)
- [CVE-2025-8224](https://cve.now/CVE-2025-8224.md): GNU Binutils BFD Library elf.c bfd\_elf\_get\_str\_section null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2025-8223](https://cve.now/CVE-2025-8223.md): jerryshensjf JPACookieShop 蛋糕商城JPA版 AdminTypeCustController.java cross-site request forgery (CVSS 5.3, jerryshensjf JPACookieShop 蛋糕商城JPA版)
- [CVE-2025-8222](https://cve.now/CVE-2025-8222.md): jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsController.java cross site scripting (CVSS 5.1, jerryshensjf JPACookieShop 蛋糕商城JPA版)
- [CVE-2025-8104](https://cve.now/CVE-2025-8104.md): Memory Usage \<= 3.98 - Cross-Site Request Forgery to Limited Plugin Installation via wpmemory\_install\_plugin Function (CVSS 4.3, sminozzi Memory Usage, Memory Limit, PHP and Server Memory…)
- [CVE-2025-8221](https://cve.now/CVE-2025-8221.md): jerryshensjf JPACookieShop 蛋糕商城JPA版 GoodsCustController.java goodsSearch cross site scripting (CVSS 5.3, jerryshensjf JPACookieShop 蛋糕商城JPA版)
- [CVE-2025-8220](https://cve.now/CVE-2025-8220.md): Engeman Web Password Recovery RecoveryPass sql injection (CVSS 6.9, Engeman Web)
- [CVE-2025-8219](https://cve.now/CVE-2025-8219.md): Shanghai Lingdang Information Technology Lingdang CRM HTTP POST Request tabdetail\_moduleSave\_dxkp.php sql injection (CVSS 5.3, Shanghai Lingdang Information Technology Lingdang CRM)
- [CVE-2025-6241](https://cve.now/CVE-2025-6241.md): CVE-2025-6241 (CVSS 4.4, Lakeside Software SysTrack)
- [CVE-2023-53156](https://cve.now/CVE-2023-53156.md): The transpose crate before 0.2.3 for Rust allows an integer overflow via input\_width and input\_height arguments. (CVSS 4.5, ejmahler transpose · transpose)
- [CVE-2023-53157](https://cve.now/CVE-2023-53157.md): The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet. (CVSS 5.3, rosenpass)
- [CVE-2024-58261](https://cve.now/CVE-2024-58261.md): The sequoia-openpgp crate 1.13.0 before 1.21.0 for Rust allows an infinite loop of "Reading a cert: Invalid operation: Not a Key packet" mes (CVSS 2.9, sequoia-pgp sequoia · sequoia-openpgp)
- [CVE-2024-58262](https://cve.now/CVE-2024-58262.md): The curve25519-dalek crate before 4.1.3 for Rust has a constant-time operation on elliptic curve scalars that is removed by LLVM. (CVSS 2.9, dalek-cryptography curve25519-dalek · curve25519-dalek)
- [CVE-2024-58263](https://cve.now/CVE-2024-58263.md): The cosmwasm-std crate before 2.0.2 for Rust allows integer overflows that cause incorrect contract calculations. (CVSS 3.7, cosmwasm-std)
- [CVE-2024-58264](https://cve.now/CVE-2024-58264.md): The serde-json-wasm crate before 1.0.1 for Rust allows stack consumption via deeply nested JSON data. (CVSS 3.2, CosmWasm serde-json-wasm · serde-json-wasm)
- [CVE-2024-58265](https://cve.now/CVE-2024-58265.md): The snow crate before 0.9.5 for Rust, when stateful TransportState is used, allows incrementing a nonce and thereby denying message delivery (CVSS 3.1, mcginty snow · snow)
- [CVE-2024-58266](https://cve.now/CVE-2024-58266.md): The shlex crate before 1.2.1 for Rust allows unquoted and unescaped instances of the { and \\xa0 characters, which may facilitate command inj (CVSS 3.2, comex shlex · shlex)
- [CVE-2025-54597](https://cve.now/CVE-2025-54597.md): LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter. (CVSS 7.2, LinuxServer Heimdall)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.