# CVEs published 2025-08-05

120 CVEs were published on August 5, 2025: 26 critical, 36 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-54872](https://cve.now/CVE-2025-54872.md): onion-site-template tor Secrets Baked Into Image (CVSS 8.7, Vessel9817 onion-site-template)
- [CVE-2025-54879](https://cve.now/CVE-2025-54879.md): Mastodon e‑mail throttle misconfiguration allows unlimited email confirmations against unconfirmed emails (CVSS 5.3, mastodon)
- [CVE-2025-54571](https://cve.now/CVE-2025-54571.md): ModSecurity's Insufficient Return Value Handling can Lead to XSS and Source Code Disclosure (CVSS 6.9, owasp-modsecurity ModSecurity)
- [CVE-2025-54884](https://cve.now/CVE-2025-54884.md): Vision UI security-kit.js: Potential Uncontrolled Resource Allocation Vulnerability (CVSS 8.7, DavidOsipov Vision-ui)
- [CVE-2025-54883](https://cve.now/CVE-2025-54883.md): Vision UI's security-kit Contains Cryptographic Weakness (CVSS 9.3, DavidOsipov Vision-ui)
- [CVE-2025-54876](https://cve.now/CVE-2025-54876.md): Jans CLI stores plaintext passwords in the local cli\_cmd.log file (CVSS 6.9, JanssenProject jans)
- [CVE-2025-54873](https://cve.now/CVE-2025-54873.md): RISC Zero Underconstrained Vulnerability: Division (CVSS 2.7, risc0 · risc0-zkvm +2)
- [CVE-2025-54869](https://cve.now/CVE-2025-54869.md): FPDI is Vulnerable to Memory Exhaustion (OOM) through its PDF Parser (CVSS 6.0, Setasign FPDI · setasign/fpdi)
- [CVE-2025-54801](https://cve.now/CVE-2025-54801.md): Fiber Susceptible to Crash via \`BodyParser\` Due to Unvalidated Large Slice Index in Decoder (CVSS 8.7, gofiber fiber · github.com/gofiber/fiber/v2)
- [CVE-2025-54594](https://cve.now/CVE-2025-54594.md): react-native-bottom-tabs: Arbitrary code execution in GitHub Actions canary workflow leads to secret exfiltration (CVSS 9.1, callstackincubator react-native-bottom-tabs)
- [CVE-2025-54125](https://cve.now/CVE-2025-54125.md): XWiki Platform: Password and email exposure in xml.vm fields (CVSS 8.7, xwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1)
- [CVE-2025-54124](https://cve.now/CVE-2025-54124.md): XWiki Platform: Any user with editing rights can access password properties through Database List Properties (CVSS 7.1, xwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1)
- [CVE-2025-32430](https://cve.now/CVE-2025-32430.md): XWiki Platform contains Reflected XSS vulnerability in two templates (CVSS 6.5, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2025-8571](https://cve.now/CVE-2025-8571.md): Concrete CMS 9 through 9.4.2 and below 8.5.21 is vulnerable to Reflected Cross-Site Scripting (XSS) in Conversation Messages Dashboard Page (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2025-8573](https://cve.now/CVE-2025-8573.md): Concrete CMS 9 through 9.4.2 is vulnerable to Stored XSS from Home Folder on Members Dashboard page (CVSS 2.0, Concrete CMS · concrete5/concrete5)
- [CVE-2025-53534](https://cve.now/CVE-2025-53534.md): RatPanel can perform remote command execution without authorization (CVSS 7.7, tnb-labs panel · github.com/tnborg/panel +3)
- [CVE-2012-10024](https://cve.now/CVE-2012-10024.md): XBMC ≤ 11.0 Web Server Path Traversal (CVSS 7.1, XBMC Media Center)
- [CVE-2012-10027](https://cve.now/CVE-2012-10027.md): WordPress Plugin WP-Property \<= 1.35.0 PHP File Upload (CVSS 9.3, WP-Property WordPress Plugin)
- [CVE-2012-10026](https://cve.now/CVE-2012-10026.md): WordPress Plugin Asset-Manager \<= 2.0 PHP File Upload (CVSS 10.0, jkriddle asset-manager)
- [CVE-2012-10025](https://cve.now/CVE-2012-10025.md): WordPress Plugin Advanced Custom Fields \<= 3.5.1 Remote File Inclusion (CVSS 10.0, Advanced Custom Fields WordPress Plugin)
- [CVE-2012-10035](https://cve.now/CVE-2012-10035.md): Turbo FTP Server 1.30.823/826 PORT Command Buffer Overflow (CVSS 10.0, TurboSoft TurboFTP Server)
- [CVE-2013-10065](https://cve.now/CVE-2013-10065.md): Sysax Multi-Server \<= 6.10 SSHD Key Exchange DoS (CVSS 8.7, Sysax Software Multi-Server)
- [CVE-2013-10070](https://cve.now/CVE-2013-10070.md): PHP-Charts v1.0 PHP Code Execution (CVSS 10.0, PHP-Charts)
- [CVE-2012-10028](https://cve.now/CVE-2012-10028.md): Netwin SurgeFTP \<= v23c8 Authenticated RCE (CVSS 8.6, Netwin SurgeFTP)
- [CVE-2012-10033](https://cve.now/CVE-2012-10033.md): Narcissus backend.php Image Configuration Command Injection (CVSS 9.3, Ångström Distribution Project Narcissus)
- [CVE-2012-10029](https://cve.now/CVE-2012-10029.md): Nagios XI Network Monitor Graph Explorer Component \< 1.3 Authenticated Command Injection (CVSS 8.6, Nagios Enterprises Nagios XI Graph Explorer)
- [CVE-2012-10032](https://cve.now/CVE-2012-10032.md): Maxthon3 about:history XCS Trusted Zone Code Execution (CVSS 8.7, Maxthon International Maxthon3 Browser)
- [CVE-2013-10066](https://cve.now/CVE-2013-10066.md): Kordil EDMS v2.2.60rc3 Unauthenticated Arbitrary File Upload (CVSS 10.0, Kordil EDMS)
- [CVE-2013-10067](https://cve.now/CVE-2013-10067.md): Glossword 1.8.8 - 1.8.12 Arbitrary File Upload RCE (CVSS 9.4, Glossword Team Glossword)
- [CVE-2012-10023](https://cve.now/CVE-2012-10023.md): FreeFloat FTP Server USER Command Buffer Overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2012-10030](https://cve.now/CVE-2012-10030.md): FreeFloat FTP Server Arbitrary File Upload (CVSS 9.3, FreeFloat FTP Server)
- [CVE-2013-10068](https://cve.now/CVE-2013-10068.md): Foxit Reader \<= 5.4.5.0114 Plugin URL Processing Buffer Overflow (CVSS 9.4, Foxit Reader)
- [CVE-2013-10069](https://cve.now/CVE-2013-10069.md): D-Link Devices Unauthenticated RCE (CVSS 10.0, D-Link DIR-600 rev B · D-Link DIR-300 rev B)
- [CVE-2012-10034](https://cve.now/CVE-2012-10034.md): ClanSphere 2011.3 Local File Inclusion via cs\_lang Cookie (CVSS 8.7, ClanSphere Project ClanSphere)
- [CVE-2012-10031](https://cve.now/CVE-2012-10031.md): BlazeVideo HDTV Player Pro 6.6.0.3 Filename Handling Buffer Overflow (CVSS 8.6, BlazeVideo HDTV Player Pro)
- [CVE-2013-10064](https://cve.now/CVE-2013-10064.md): ActFax 5.01 RAW Server Buffer Overflow (CVSS 9.3, ActFax Communication ActFax Server)
- [CVE-2014-125113](https://cve.now/CVE-2014-125113.md): Dell/Quest KACE K1000 Unauthenticated File Upload RCE (CVSS 9.3, Dell/Quest KACE K1000 Systems Management Appliance)
- [CVE-2025-8586](https://cve.now/CVE-2025-8586.md): libav MPEG File Parser utils.c ff\_seek\_frame\_binary null pointer dereference (CVSS 4.8, libav)
- [CVE-2025-8585](https://cve.now/CVE-2025-8585.md): libav DSS File Demuxer avconv.c main double free (CVSS 4.8, libav)
- [CVE-2025-54253](https://cve.now/CVE-2025-54253.md): Adobe Experience Manager | Incorrect Authorization (CWE-863) (CVSS 10.0, KEV, Adobe Experience Manager)
- [CVE-2025-54254](https://cve.now/CVE-2025-54254.md): Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 8.6, Adobe Experience Manager)
- [CVE-2025-7674](https://cve.now/CVE-2025-7674.md): navify Monitoring API input validation (CVSS 7.1, Roche Diagnostics navify Monitoring)
- [CVE-2025-8584](https://cve.now/CVE-2025-8584.md): libav AVI File Parser buffer.c av\_buffer\_unref null pointer dereference (CVSS 4.8, libav)
- [CVE-2025-2611](https://cve.now/CVE-2025-2611.md): ICTBroadcast \<= 7.4 Unauthenticated Session Cookie RCE (CVSS 9.3, ICT Innovations ICTBroadcast)
- [CVE-2025-27931](https://cve.now/CVE-2025-27931.md): An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Editor version 10.5.2.395. (CVSS 6.5, PDF-XChange Co. PDF-XChange Editor)
- [CVE-2025-47152](https://cve.now/CVE-2025-47152.md): An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. (CVSS 6.5, PDF-XChange Co. PDF-XChange Editor)
- [CVE-2025-54874](https://cve.now/CVE-2025-54874.md): OpenJPEG allows OOB heap memory write in opj\_jp2\_read\_header (CVSS 6.6, uclouvain openjpeg)
- [CVE-2025-46958](https://cve.now/CVE-2025-46958.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-52890](https://cve.now/CVE-2024-52890.md): IBM Engineering Lifecycle Optimization - Publishing cross-site scripting (CVSS 6.1, IBM Engineering Lifecycle Optimization - Publishing)
- [CVE-2025-7033](https://cve.now/CVE-2025-7033.md): Rockwell Automation Heap-based Buffer Overflow In Arena® Simulation (CVSS 8.4, Rockwell Automation Arena® Simulation)
- [CVE-2025-7032](https://cve.now/CVE-2025-7032.md): Rockwell Automation Stack-based Buffer Overflow In Arena® Simulation (CVSS 8.4, Rockwell Automation Arena® Simulation)
- [CVE-2025-7025](https://cve.now/CVE-2025-7025.md): Rockwell Automation Heap-based Buffer Overflow In Arena® Simulation (CVSS 8.4, Rockwell Automation Arena® Simulation)
- [CVE-2025-54987](https://cve.now/CVE-2025-54987.md): A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious (CVSS 9.4, Trend Micro Apex One)
- [CVE-2025-54948](https://cve.now/CVE-2025-54948.md): A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious (CVSS 9.4, KEV, Trend Micro Apex One)
- [CVE-2025-8555](https://cve.now/CVE-2025-8555.md): atjiu pybbs search cross site scripting (CVSS 5.1, atjiu pybbs)
- [CVE-2025-8554](https://cve.now/CVE-2025-8554.md): atjiu pybbs list cross site scripting (CVSS 4.8, atjiu pybbs)
- [CVE-2025-8553](https://cve.now/CVE-2025-8553.md): atjiu pybbs list cross site scripting (CVSS 4.8, atjiu pybbs)
- [CVE-2025-2810](https://cve.now/CVE-2025-2810.md): Draeger: ICMHelper is vulnerable to use of Hard-coded Cryptographic Key (CVSS 5.5, Draeger ICMHelper)
- [CVE-2025-41698](https://cve.now/CVE-2025-41698.md): Draeger: ICMHelper is vulnerable to a privilege escalation due too missing authorization (CVSS 7.8, Draeger ICMHelper)
- [CVE-2025-8552](https://cve.now/CVE-2025-8552.md): atjiu pybbs list cross site scripting (CVSS 4.8, atjiu pybbs)
- [CVE-2025-8551](https://cve.now/CVE-2025-8551.md): atjiu pybbs list cross site scripting (CVSS 5.1, atjiu pybbs)
- [CVE-2025-8294](https://cve.now/CVE-2025-8294.md): Download Counter \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter (CVSS 6.4, anatolyk Download Counter)
- [CVE-2025-8295](https://cve.now/CVE-2025-8295.md): Employee Directory \<= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess\_msg Parameter (CVSS 6.4, emarket-design Employee Directory – Staff & Team Directory)
- [CVE-2025-5061](https://cve.now/CVE-2025-5061.md): WP Import Export Lite \<= 3.9.29 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5, vjinfotech WP Import Export Lite)
- [CVE-2025-6207](https://cve.now/CVE-2025-6207.md): WP Import Export Lite \<= 3.9.28 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 7.5, vjinfotech WP Import Export Lite)
- [CVE-2025-8550](https://cve.now/CVE-2025-8550.md): atjiu pybbs list cross site scripting (CVSS 4.8, atjiu pybbs)
- [CVE-2025-8313](https://cve.now/CVE-2025-8313.md): Campus Directory \<= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess\_msg Parameter (CVSS 6.4, emarket-design Campus Directory – Faculty, Staff & Student…)
- [CVE-2025-7050](https://cve.now/CVE-2025-7050.md): Use-your-Drive | Google Drive plugin for WordPress \<= 3.3.1- Unauthenticated Stored Cross-Site Scripting via File Metadata (CVSS 7.2, WP Cloud Plugins/\_deleeuw\_ Use-your-Drive | Google Drive pl…)
- [CVE-2025-8315](https://cve.now/CVE-2025-8315.md): WP Easy Contact \<= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess\_msg Parameter (CVSS 6.4, emarket-design Simple Contact Form Plugin for WordPress – W…)
- [CVE-2025-8549](https://cve.now/CVE-2025-8549.md): atjiu pybbs UserAdminController.java update weak password (CVSS 6.3, atjiu pybbs)
- [CVE-2025-8548](https://cve.now/CVE-2025-8548.md): atjiu pybbs Registered Email SettingsApiController.java sendEmailCode information exposure (CVSS 6.3, atjiu pybbs)
- [CVE-2025-54982](https://cve.now/CVE-2025-54982.md): SAML 2.0 Public Key Validation Issue (CVSS 9.6, Zscaler Authentication Server)
- [CVE-2025-8547](https://cve.now/CVE-2025-8547.md): atjiu pybbs Email Verification improper authorization (CVSS 6.9, atjiu pybbs)
- [CVE-2025-8546](https://cve.now/CVE-2025-8546.md): atjiu pybbs Verification Code login Captcha (CVSS 6.9, atjiu pybbs)
- [CVE-2025-54868](https://cve.now/CVE-2025-54868.md): LibreChat exposes arbitrary chats through Meilisearch engine (CVSS 7.5, danny-avila LibreChat)
- [CVE-2025-8545](https://cve.now/CVE-2025-8545.md): Portabilis i-Educar educar\_motivo\_afastamento\_cad.php cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-8544](https://cve.now/CVE-2025-8544.md): Portabilis i-Educar edit cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-8543](https://cve.now/CVE-2025-8543.md): Portabilis i-Educar educar\_raca\_cad.php cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-8542](https://cve.now/CVE-2025-8542.md): Portabilis i-Educar empresas\_cad.php cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-8541](https://cve.now/CVE-2025-8541.md): Portabilis i-Educar public\_uf\_cad.php cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-53417](https://cve.now/CVE-2025-53417.md): File Parsing Deserialization of Untrusted Data in DTM Soft (CVSS 9.3, Delta Electronics DIAView)
- [CVE-2025-8540](https://cve.now/CVE-2025-8540.md): Portabilis i-Educar public\_municipio\_cad.php cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-8539](https://cve.now/CVE-2025-8539.md): Portabilis i-Educar public\_distrito\_cad.php cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-8538](https://cve.now/CVE-2025-8538.md): Portabilis i-Educar novo cross site scripting (CVSS 4.8, Portabilis i-Educar)
- [CVE-2025-8537](https://cve.now/CVE-2025-8537.md): Axiomatic Bento4 mp4decrypt Mp4Decrypt.cpp SetDataSize allocation of resources (CVSS 6.3, Axiomatic Bento4)
- [CVE-2025-52892](https://cve.now/CVE-2025-52892.md): EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache (CVSS 4.5, espocrm)
- [CVE-2025-53544](https://cve.now/CVE-2025-53544.md): Trilium Notes is Vulnerable to Brute-force Protection Bypass via Initial Sync Seed Retrieval (CVSS 7.5, TriliumNext Trilium)
- [CVE-2025-54119](https://cve.now/CVE-2025-54119.md): ADOdb's sqlite3 driver allows SQL injection (CVSS 10.0, ADOdb · adodb/adodb-php)
- [CVE-2025-54130](https://cve.now/CVE-2025-54130.md): Cursor Agent is vulnerable prompt injection via Editor Special Files (CVSS 7.5, cursor)
- [CVE-2025-54135](https://cve.now/CVE-2025-54135.md): Cursor Agent is vulnerable to prompt injection via MCP Special Files (CVSS 8.6, cursor)
- [CVE-2025-54387](https://cve.now/CVE-2025-54387.md): IPX is Vulnerable to Path Traversal via Prefix Matching Bypass (CVSS 6.9, unjs ipx · ipx)
- [CVE-2025-54780](https://cve.now/CVE-2025-54780.md): glpi-screenshot-plugin exposes local files in /ajax/screenshot.php (CVSS 7.7, cconard96 glpi-screenshot-plugin)
- [CVE-2025-54794](https://cve.now/CVE-2025-54794.md): Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access (CVSS 7.7, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-54795](https://cve.now/CVE-2025-54795.md): Claude Code echo command allowed bypass of user approval prompt for command execution (CVSS 8.7, anthropics claude-code · @anthropic-ai/claude-code)
- [CVE-2025-54802](https://cve.now/CVE-2025-54802.md): pyLoad CNL Blueprint is vulnerable to Path Traversal through \`dlc\_path\` leading to Remote Code Execution (RCE) (CVSS 9.8, pyload · pyload-ng)
- [CVE-2025-54803](https://cve.now/CVE-2025-54803.md): js-toml is vulnerable to Prototype Pollution (CVSS 7.9, sunnyadn js-toml · js-toml)
- [CVE-2025-54804](https://cve.now/CVE-2025-54804.md): Russh is missing an overflow check during channel windows adjust (CVSS 6.5, Eugeny russh · russh)
- [CVE-2025-54865](https://cve.now/CVE-2025-54865.md): Tilesheets MediaWiki Extension is Vulnerable to Potential SQL Injection (CVSS 7.3, FTB-Gamepedia Tilesheets)
- [CVE-2025-54871](https://cve.now/CVE-2025-54871.md): Electron Capture is Vulnerable to TCC Bypass via Misconfigured Node Fuses (macOS) (CVSS 5.5, steveseguin electroncapture)
- [CVE-2025-54870](https://cve.now/CVE-2025-54870.md): VTun-ng's failure to initialize encryption modules may cause reversion to plaintext (CVSS 8.7, leakingmemory vtun-ng)
- [CVE-2025-8535](https://cve.now/CVE-2025-8535.md): cronoh NanoVault xrb URL main.js executeJavaScript cross site scripting (CVSS 5.1, cronoh NanoVault)
- [CVE-2025-29745](https://cve.now/CVE-2025-29745.md): A vulnerability affecting the scanning module in Emsisoft Anti-Malware prior to 2024.12 allows attackers on a remote server to obtain Net-NT (CVSS 7.5)
- [CVE-2025-43978](https://cve.now/CVE-2025-43978.md): Jointelli 5G CPE 21H01 firmware JY\_21H01\_A3\_v1.36 devices allow (blind) OS command injection. (CVSS 7.4)
- [CVE-2025-43979](https://cve.now/CVE-2025-43979.md): An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN that allows authenticated attackers to execute arbitrary OS system co (CVSS 7.4)
- [CVE-2025-43980](https://cve.now/CVE-2025-43980.md): An issue was discovered on FIRSTNUM JC21A-04 devices through 2.01ME/FN. (CVSS 6.5)
- [CVE-2025-44964](https://cve.now/CVE-2025-44964.md): A lack of SSL certificate validation in BlueStacks v5.20 allows attackers to execute a man-it-the-middle attack and obtain sensitive informa (CVSS 3.9)
- [CVE-2025-45512](https://cve.now/CVE-2025-45512.md): A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install craft (CVSS 6.5)
- [CVE-2025-46658](https://cve.now/CVE-2025-46658.md): An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. (CVSS 9.8)
- [CVE-2025-50454](https://cve.now/CVE-2025-50454.md): An Authentication Bypass vulnerability in Blue Access' Cobalt X1 thru 02.000.187 allows an unauthorized attacker to log into the application (CVSS 6.5)
- [CVE-2025-50592](https://cve.now/CVE-2025-50592.md): Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player. (CVSS 5.4)
- [CVE-2025-50688](https://cve.now/CVE-2025-50688.md): A command injection vulnerability exists in TwistedWeb (version 14.0.0) due to improper input sanitization in the file upload functionality. (CVSS 6.5)
- [CVE-2025-50706](https://cve.now/CVE-2025-50706.md): An issue in thinkphp v.5.1 allows a remote attacker to execute arbitrary code via the routecheck function (CVSS 9.8, topthink/framework)
- [CVE-2025-50707](https://cve.now/CVE-2025-50707.md): An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component (CVSS 9.8)
- [CVE-2025-51060](https://cve.now/CVE-2025-51060.md): An issue was discovered in CPUID cpuz.sys 1.0.5.4. (CVSS 6.5)
- [CVE-2025-51541](https://cve.now/CVE-2025-51541.md): A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuratio (CVSS 6.1)
- [CVE-2025-51627](https://cve.now/CVE-2025-51627.md): Incorrect access control in CaricaVerbale in Agenzia Impresa Eccobook v2.81.1 allows authenticated attackers with low-level access to escala (CVSS 6.5)
- [CVE-2025-51628](https://cve.now/CVE-2025-51628.md): Insecure Direct Object Reference (IDOR) vulnerability in PdfHandler component in Agenzia Impresa Eccobook v2.81.1 and below allows unauthent (CVSS 7.5)
- [CVE-2025-51857](https://cve.now/CVE-2025-51857.md): The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks. (CVSS 6.1)
- [CVE-2025-52078](https://cve.now/CVE-2025-52078.md): File upload vulnerability in Writebot AI Content Generator SaaS React Template thru 4.0.0, allowing remote attackers to gain escalated privi (CVSS 6.5)
- [CVE-2025-52237](https://cve.now/CVE-2025-52237.md): An issue in the component /stl/actions/download?filePath of SSCMS v7.3.1 allows attackers to execute a directory traversal. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.