# CVEs published 2025-08-02

42 CVEs were published on August 2, 2025: 2 critical, 10 high. Days are UTC.

- [CVE-2025-8494](https://cve.now/CVE-2025-8494.md): code-projects Intern Membership Management System delete\_student.php sql injection (CVSS 6.9, code-projects Intern Membership Management System)
- [CVE-2025-8493](https://cve.now/CVE-2025-8493.md): code-projects Intern Membership Management System edit\_student\_query.php sql injection (CVSS 6.9, code-projects Intern Membership Management System)
- [CVE-2023-32253](https://cve.now/CVE-2023-32253.md): Kernel: deadlock in ksmbd\_find\_crypto\_ctx() (CVSS 5.9, linux · Red Hat Enterprise Linux)
- [CVE-2023-32255](https://cve.now/CVE-2023-32255.md): Kernel: memory leak via ksmbd session setup request with unknown ntlmssp message type (CVSS 5.3, linux · Red Hat Enterprise Linux)
- [CVE-2025-23290](https://cve.now/CVE-2025-23290.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a guest could get global GPU metrics which may be influenced (CVSS 2.5, NVIDIA GPU Display Drivers)
- [CVE-2025-23285](https://cve.now/CVE-2025-23285.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where it allows a guest to access global resources. (CVSS 5.5, NVIDIA GPU Display Drivers)
- [CVE-2025-23284](https://cve.now/CVE-2025-23284.md): NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause a stack buffer overflow. (CVSS 7.8, NVIDIA GPU Display Drivers)
- [CVE-2025-23283](https://cve.now/CVE-2025-23283.md): NVIDIA vGPU software for Linux-style hypervisors contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause st (CVSS 7.8, NVIDIA GPU Display Drivers)
- [CVE-2025-23288](https://cve.now/CVE-2025-23288.md): NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may cause an exposure of sensitive system information with (CVSS 3.3, NVIDIA GPU Display Drivers)
- [CVE-2025-23287](https://cve.now/CVE-2025-23287.md): NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may access sensitive system-level information. (CVSS 3.3, NVIDIA GPU Display Drivers)
- [CVE-2025-23286](https://cve.now/CVE-2025-23286.md): NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an attacker could read invalid memory. (CVSS 4.4, NVIDIA GPU Display Drivers)
- [CVE-2025-23281](https://cve.now/CVE-2025-23281.md): NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker with local unprivileged access that can win a race conditio (CVSS 7.0, NVIDIA GPU Display Drivers)
- [CVE-2025-23279](https://cve.now/CVE-2025-23279.md): NVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race condition to escalate privileges. (CVSS 7.0, NVIDIA GPU Display Drivers)
- [CVE-2025-23278](https://cve.now/CVE-2025-23278.md): NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a (CVSS 7.1, NVIDIA GPU Display Drivers)
- [CVE-2025-23277](https://cve.now/CVE-2025-23277.md): NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outsid (CVSS 7.3, NVIDIA GPU Display Drivers)
- [CVE-2025-23276](https://cve.now/CVE-2025-23276.md): NVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate privileges. (CVSS 7.8, NVIDIA GPU Display Drivers)
- [CVE-2025-8471](https://cve.now/CVE-2025-8471.md): projectworlds Online Admission System adminlogin.php sql injection (CVSS 6.9, projectworlds Online Admission System)
- [CVE-2025-8470](https://cve.now/CVE-2025-8470.md): SourceCodester Online Hotel Reservation System deleteroom.php sql injection (CVSS 6.9, SourceCodester Online Hotel Reservation System)
- [CVE-2025-8469](https://cve.now/CVE-2025-8469.md): SourceCodester Online Hotel Reservation System deletegallery.php sql injection (CVSS 6.9, SourceCodester Online Hotel Reservation System)
- [CVE-2025-8468](https://cve.now/CVE-2025-8468.md): code-projects Wazifa System reset.php sql injection (CVSS 6.9, code-projects Wazifa System)
- [CVE-2025-7500](https://cve.now/CVE-2025-7500.md): Ocean Social Sharing \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, oceanwp Ocean Social Sharing)
- [CVE-2025-7710](https://cve.now/CVE-2025-7710.md): Brave Conversion Engine (PRO) \<= 0.7.7 - Authentication Bypass to Administrator (CVSS 9.8, Brave Conversion Engine)
- [CVE-2025-8467](https://cve.now/CVE-2025-8467.md): code-projects Wazifa System regcontrol.php sql injection (CVSS 6.9, code-projects Wazifa System)
- [CVE-2025-8488](https://cve.now/CVE-2025-8488.md): Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) \<= 2.4.6 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (CVSS 4.3, brainstormforce Ultimate Addons for Elementor)
- [CVE-2025-6722](https://cve.now/CVE-2025-6722.md): BitFire \<= 4.5 - Unauthenticated Information Exposure (CVSS 5.3, bitslip6 BitFire Security – Firewall, WAF, Bot/Spam Blocker…)
- [CVE-2025-8466](https://cve.now/CVE-2025-8466.md): code-projects Online Farm System forgot\_passfarmer.php sql injection (CVSS 6.9, code-projects Online Farm System)
- [CVE-2025-8391](https://cve.now/CVE-2025-8391.md): Magic Edge – Lite \<= 1.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via height Parameter (CVSS 6.4, awssoft Magic Edge – Lite)
- [CVE-2025-8400](https://cve.now/CVE-2025-8400.md): Image Gallery \<= 1.0.0 - Reflected Cross-Site Scripting (CVSS 6.1, aumsrini Image Gallery)
- [CVE-2025-6832](https://cve.now/CVE-2025-6832.md): All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier \<= 2.0 - Reflected Cross-Site Scripting (CVSS 6.1, codebangers All in One Time Clock Lite – Tracking Employee…)
- [CVE-2025-8399](https://cve.now/CVE-2025-8399.md): Mmm Unity Loader \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via attributes Parameter (CVSS 6.4, mmanifesto Mmm Unity Loader)
- [CVE-2025-8317](https://cve.now/CVE-2025-8317.md): Custom Word Cloud \<= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via angle Parameter (CVSS 6.4, bnielsen Custom Word Cloud)
- [CVE-2025-4588](https://cve.now/CVE-2025-4588.md): 360 Photo Spheres \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mrgoodfellow 360 Photo Spheres)
- [CVE-2025-8212](https://cve.now/CVE-2025-8212.md): Medical Addon for Elementor \<= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget (CVSS 6.4, nicheaddons Medical Addon for Elementor)
- [CVE-2025-8152](https://cve.now/CVE-2025-8152.md): WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons \<= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update (CVSS 5.3, blendmedia WP CTA – Call Now Button, Sticky Button & Call t…)
- [CVE-2025-6626](https://cve.now/CVE-2025-6626.md): ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization \<= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL (CVSS 4.4, ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimiz…)
- [CVE-2025-6754](https://cve.now/CVE-2025-6754.md): SEO Metrics \<= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, seometricsplugin SEO Metrics)
- [CVE-2025-8146](https://cve.now/CVE-2025-8146.md): Qi Addons for Elementor \<= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget (CVSS 6.4, qodeinteractive Qi Addons For Elementor)
- [CVE-2025-7694](https://cve.now/CVE-2025-7694.md): Woffice Core \<= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion (CVSS 6.8, WofficeIO Woffice Core)
- [CVE-2025-6078](https://cve.now/CVE-2025-6078.md): CVE-2025-6078 (CVSS 5.4, Partner Software Partner Web)
- [CVE-2025-6077](https://cve.now/CVE-2025-6077.md): CVE-2025-6077 (CVSS 9.8, Partner Software Partner Web)
- [CVE-2025-6076](https://cve.now/CVE-2025-6076.md): CVE-2025-6076 (CVSS 8.8, Partner Software Partner Web)
- [CVE-2025-54955](https://cve.now/CVE-2025-54955.md): OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can le (CVSS 8.1, OpenNebula)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.