# CVEs published 2025-08-03 29 CVEs were published on August 3, 2025: 0 critical, 3 high. Days are UTC. - [CVE-2025-8513](https://cve.now/CVE-2025-8513.md): Caixin News App com.caixin.news AndroidManifest.xml improper export of android application components (CVSS 4.8, Caixin News App) - [CVE-2025-8512](https://cve.now/CVE-2025-8512.md): TVB Big Big Shop App hk.com.tvb.bigbigshop AndroidManifest.xml improper export of android application components (CVSS 4.8, TVB Big Big Shop App) - [CVE-2025-8511](https://cve.now/CVE-2025-8511.md): Portabilis i-Diario Observações diario-de-observacoes cross site scripting (CVSS 5.1, Portabilis i-Diario) - [CVE-2025-8510](https://cve.now/CVE-2025-8510.md): Portabilis i-Educar educar\_matricula\_lst.php Gerar cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-8509](https://cve.now/CVE-2025-8509.md): Portabilis i-Educar educar\_servidor\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-8508](https://cve.now/CVE-2025-8508.md): Portabilis i-Educar educar\_avaliacao\_desempenho\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2024-51775](https://cve.now/CVE-2024-51775.md): Apache Zeppelin: Command Injection via CSWSH (CVSS 7.5, Apache Software Foundation Apache Zeppelin · org.apache.zep…) - [CVE-2024-41177](https://cve.now/CVE-2024-41177.md): Apache Zeppelin: XSS in the Helium module (CVSS 6.1, Apache Software Foundation Apache Zeppelin · org.apache.zep…) - [CVE-2025-8507](https://cve.now/CVE-2025-8507.md): Portabilis i-Educar educar\_funcao\_lst.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2024-52279](https://cve.now/CVE-2024-52279.md): Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string (CVSS 7.5, Apache Software Foundation Apache Zeppelin · org.apache.zep…) - [CVE-2025-8506](https://cve.now/CVE-2025-8506.md): 495300897 wx-shop editUI cross site scripting (CVSS 5.1, 495300897 wx-shop) - [CVE-2025-8505](https://cve.now/CVE-2025-8505.md): 495300897 wx-shop cross-site request forgery (CVSS 5.3, 495300897 wx-shop) - [CVE-2025-8504](https://cve.now/CVE-2025-8504.md): code-projects Kitchen Treasure userregistration.php unrestricted upload (CVSS 5.3, code-projects Kitchen Treasure) - [CVE-2025-8503](https://cve.now/CVE-2025-8503.md): code-projects Online Medicine Guide adaddmed.php sql injection (CVSS 6.9, code-projects Online Medicine Guide) - [CVE-2025-8502](https://cve.now/CVE-2025-8502.md): code-projects Online Medicine Guide changepass.php sql injection (CVSS 6.9, code-projects Online Medicine Guide) - [CVE-2025-8501](https://cve.now/CVE-2025-8501.md): code-projects Human Resource Integrated System action.php cross site scripting (CVSS 5.1, code-projects Human Resource Integrated System) - [CVE-2025-8500](https://cve.now/CVE-2025-8500.md): code-projects Human Resource Integrated System action.php sql injection (CVSS 5.3, code-projects Human Resource Integrated System) - [CVE-2025-8499](https://cve.now/CVE-2025-8499.md): code-projects Online Medicine Guide cusfindambulence2.php sql injection (CVSS 6.9, code-projects Online Medicine Guide) - [CVE-2025-8498](https://cve.now/CVE-2025-8498.md): code-projects Online Medicine Guide index.php sql injection (CVSS 6.9, code-projects Online Medicine Guide) - [CVE-2025-8497](https://cve.now/CVE-2025-8497.md): code-projects Online Medicine Guide cusfindphar2.php sql injection (CVSS 6.9, code-projects Online Medicine Guide) - [CVE-2025-8496](https://cve.now/CVE-2025-8496.md): projectworlds Online Admission System viewform.php sql injection (CVSS 6.9, projectworlds Online Admission System) - [CVE-2025-8495](https://cve.now/CVE-2025-8495.md): code-projects Intern Membership Management System edit\_admin\_query.php sql injection (CVSS 6.9, code-projects Intern Membership Management System) - [CVE-2025-52131](https://cve.now/CVE-2025-52131.md): The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field. (CVSS 6.4, xwiki-contrib Mocca Calendar) - [CVE-2025-52132](https://cve.now/CVE-2025-52132.md): The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page. (CVSS 6.4, xwiki-contrib Mocca Calendar) - [CVE-2025-52133](https://cve.now/CVE-2025-52133.md): The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import. (CVSS 6.4, xwiki-contrib Mocca Calendar) - [CVE-2025-54349](https://cve.now/CVE-2025-54349.md): In iperf before 3.19.1, iperf\_auth.c has an off-by-one error and resultant heap-based buffer overflow. (CVSS 6.5, ES iperf3) - [CVE-2025-54350](https://cve.now/CVE-2025-54350.md): In iperf before 3.19.1, iperf\_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt. (CVSS 3.7, ES iperf3) - [CVE-2025-54351](https://cve.now/CVE-2025-54351.md): In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG\_TRUNC in recv). (CVSS 8.9, ES iperf3) - [CVE-2025-54956](https://cve.now/CVE-2025-54956.md): The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the correspondin (CVSS 3.2, r-lib gh) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-08-03 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.