# CVEs published 2025-08-08

76 CVEs were published on August 8, 2025: 22 critical, 17 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-8744](https://cve.now/CVE-2025-8744.md): CesiumLab Web lodmodels sql injection (CVSS 6.9, CesiumLab Web)
- [CVE-2025-46709](https://cve.now/CVE-2025-46709.md): GPU DDK - Security fix for PP-171570 can lead to an uninitialised pointer dereference and memory leak (CVSS 7.5, Imagination Technologies Graphics DDK)
- [CVE-2025-6573](https://cve.now/CVE-2025-6573.md): GPU DDK - RGXFW\_CTL.pui8FWScratchBuf Leak/Overwrite (CVSS 9.8, Imagination Technologies Graphics DDK)
- [CVE-2025-8743](https://cve.now/CVE-2025-8743.md): Scada-LTS Virtual Data Source Property data\_source\_edit.shtm cross site scripting (CVSS 5.1, Scada-LTS)
- [CVE-2025-8742](https://cve.now/CVE-2025-8742.md): macrozheng mall Admin Login excessive authentication (CVSS 6.3, macrozheng mall)
- [CVE-2025-8741](https://cve.now/CVE-2025-8741.md): macrozheng mall login cleartext transmission (CVSS 6.3, macrozheng mall)
- [CVE-2025-8740](https://cve.now/CVE-2025-8740.md): zhenfeng13 My-Blog Category save cross site scripting (CVSS 4.8, zhenfeng13 My-Blog)
- [CVE-2025-8739](https://cve.now/CVE-2025-8739.md): zhenfeng13 My-Blog save cross-site request forgery (CVSS 5.3, zhenfeng13 My-Blog)
- [CVE-2025-8738](https://cve.now/CVE-2025-8738.md): zlt2000 microservices-platform Spring Actuator Interface actuator information disclosure (CVSS 6.9, zlt2000 microservices-platform)
- [CVE-2025-8737](https://cve.now/CVE-2025-8737.md): zlt2000 microservices-platform OauthLogoutSuccessHandler.java onLogoutSuccess redirect (CVSS 5.1, zlt2000 microservices-platform)
- [CVE-2025-8736](https://cve.now/CVE-2025-8736.md): GNU cflow Lexer c.c yylex buffer overflow (CVSS 4.8, GNU cflow)
- [CVE-2025-8735](https://cve.now/CVE-2025-8735.md): GNU cflow Lexer c.c yylex null pointer dereference (CVSS 4.8, GNU cflow)
- [CVE-2025-4796](https://cve.now/CVE-2025-4796.md): Eventin \<= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover (CVSS 8.8, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2012-10048](https://cve.now/CVE-2012-10048.md): Zenoss 3.x showDaemonXMLConfig Command Execution (CVSS 8.7, Zenoss Core)
- [CVE-2012-10045](https://cve.now/CVE-2012-10045.md): XODA 0.4.5 Arbitrary PHP File Upload (CVSS 9.3, XODA)
- [CVE-2012-10049](https://cve.now/CVE-2012-10049.md): WebPageTest Arbitrary PHP File Upload RCE (CVSS 9.3, WPO Foundation WebPageTest)
- [CVE-2012-10041](https://cve.now/CVE-2012-10041.md): WAN Emulator v2.3 Command Execution (CVSS 9.3, WAN Emulator)
- [CVE-2012-10053](https://cve.now/CVE-2012-10053.md): Simple Web Server Connection Header Buffer Overflow (CVSS 9.3, PMSoftware Simple Web Server)
- [CVE-2012-10042](https://cve.now/CVE-2012-10042.md): Sflog! CMS 1.0 Arbitrary File Upload RCE (CVSS 8.7, Sflog! CMS)
- [CVE-2012-10036](https://cve.now/CVE-2012-10036.md): Project Pier \<= 0.8.8 Arbitrary File Upload RCE (CVSS 9.3, ProjectPier)
- [CVE-2012-10051](https://cve.now/CVE-2012-10051.md): Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow (CVSS 8.4, Photodex ProShow Producer)
- [CVE-2012-10044](https://cve.now/CVE-2012-10044.md): MobileCartly 1.0 savepage.php Arbitrary File Creation (CVSS 10.0, MobileCartly)
- [CVE-2012-10046](https://cve.now/CVE-2012-10046.md): E-Mail Security Virtual Appliance learn-msg.cgi Command Injection (CVSS 9.3, ESVA-Project E-Mail Security Virtual Appliance)
- [CVE-2012-10052](https://cve.now/CVE-2012-10052.md): EGallery 1.2 Arbitrary PHP File Upload (CVSS 9.3, EGallery)
- [CVE-2012-10047](https://cve.now/CVE-2012-10047.md): Cyclope Employee Surveillance Solution v6.x SQL Injection (CVSS 10.0, Cyclope-Series Cyclope Employee Surveillance Solution)
- [CVE-2012-10050](https://cve.now/CVE-2012-10050.md): CuteFlow \<= 2.11.2 Arbitrary File Upload RCE (CVSS 9.3, CuteFlow.org CuteFlow)
- [CVE-2010-10013](https://cve.now/CVE-2010-10013.md): AjaXplorer \< 2.6 checkInstall.php Unauthenticated RCE (CVSS 9.3, AjaXplorer)
- [CVE-2012-10043](https://cve.now/CVE-2012-10043.md): ActFax 4.32 Client Importer Buffer Overflow (CVSS 9.3, ActFax Server)
- [CVE-2025-5095](https://cve.now/CVE-2025-5095.md): Burk Technology ARC Solo Missing Authentication for Critical Function (CVSS 9.8, Burk Technology ARC Solo)
- [CVE-2025-8732](https://cve.now/CVE-2025-8732.md): libxml2 xmlcatalog xmlParseSGMLCatalog recursion (CVSS 4.8, libxml2)
- [CVE-2025-8284](https://cve.now/CVE-2025-8284.md): Packet Power EMX and EG Missing Authentication for Critical Function (CVSS 9.8, Packet Power EMX · Packet Power EG)
- [CVE-2025-8393](https://cve.now/CVE-2025-8393.md): Dreame Technology iOS and Android Mobile Applications Improper Certificate Validation (CVSS 7.3, Dreame Technology Dreamehome iOS app · Dreame Technology… +1)
- [CVE-2025-46414](https://cve.now/CVE-2025-46414.md): EG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication Attempts (CVSS 8.1, EG4 Electronics EG4 12kPV · EG4 Electronics EG4 18kPV +4)
- [CVE-2025-47872](https://cve.now/CVE-2025-47872.md): EG4 Electronics EG4 Inverters Observable Discrepancy (CVSS 5.8, EG4 Electronics EG4 12kPV · EG4 Electronics EG4 18kPV +4)
- [CVE-2025-53520](https://cve.now/CVE-2025-53520.md): EG4 Electronics EG4 Inverters Download of Code Without Integrity Check (CVSS 8.8, EG4 Electronics EG4 12kPV · EG4 Electronics EG4 18kPV +4)
- [CVE-2025-52586](https://cve.now/CVE-2025-52586.md): EG4 Electronics EG4 Inverters Cleartext Transmission of Sensitive Information (CVSS 6.9, EG4 Electronics EG4 12kPV · EG4 Electronics EG4 18kPV +4)
- [CVE-2025-4576](https://cve.now/CVE-2025-4576.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-8356](https://cve.now/CVE-2025-8356.md): Path Traversal leading to RCE (CVSS 9.8, Xerox FreeFlow Core)
- [CVE-2025-8731](https://cve.now/CVE-2025-8731.md): TRENDnet TI-G160i/TI-PG102i/TPL-430AP SSH Service default credentials (CVSS 9.3, TRENDnet TI-G160i · TRENDnet TI-PG102i +1)
- [CVE-2025-8355](https://cve.now/CVE-2025-8355.md): XXE leading to SSRF (CVSS 7.5, Xerox FreeFlow Core)
- [CVE-2025-36023](https://cve.now/CVE-2025-36023.md): IBM Cloud Pak for Business Automation security bypass (CVSS 6.5, IBM Cloud Pak for Business Automation)
- [CVE-2025-8730](https://cve.now/CVE-2025-8730.md): Belkin F9K1009/F9K1010 Web Interface hard-coded credentials (CVSS 9.3, Belkin F9K1009 · Belkin F9K1010)
- [CVE-2025-36119](https://cve.now/CVE-2025-36119.md): IBM i authentication bypass (CVSS 7.1, IBM i)
- [CVE-2025-8729](https://cve.now/CVE-2025-8729.md): MigoXLab LMeterX upload\_service.py process\_cert\_files path traversal (CVSS 5.3, MigoXLab LMeterX)
- [CVE-2025-8749](https://cve.now/CVE-2025-8749.md): Path traversal vulnerability in MiR robot software via API requests (CVSS 6.5, Mobile Industrial Robots MiR Robots)
- [CVE-2025-8088](https://cve.now/CVE-2025-8088.md): Path traversal vulnerability in WinRAR (CVSS 8.4, KEV, win.rar WinRAR)
- [CVE-2025-8748](https://cve.now/CVE-2025-8748.md): OS command injection in MiR robots and MiR fleet via crafted HTTP requests (CVSS 8.8, Mobile Industrial Robots MiR Robots · Mobile Industrial Rob…)
- [CVE-2025-53606](https://cve.now/CVE-2025-53606.md): Apache Seata (incubating): Deserialization of untrusted Data in Apache Seata Server (CVSS 9.8, Apache Software Foundation Apache Seata · org.apache.seata:…)
- [CVE-2025-48913](https://cve.now/CVE-2025-48913.md): Apache CXF: Untrusted JMS configuration can lead to RCE (CVSS 9.8, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2025-6572](https://cve.now/CVE-2025-6572.md): OpenStreetMap for Gutenberg and WPBakery Page Builder \<= 1.2.0 - Contributor+ Stored XSS (CVSS 5.9, OpenStreetMap for Gutenberg and WPBakery Page Builder)
- [CVE-2025-54958](https://cve.now/CVE-2025-54958.md): Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. (CVSS 6.3, Mubit co. Powered BLUE)
- [CVE-2025-54959](https://cve.now/CVE-2025-54959.md): Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. (CVSS 4.3, Mubit co. Powered BLUE)
- [CVE-2025-54940](https://cve.now/CVE-2025-54940.md): An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. (CVSS 3.4, WPEngine Advanced Custom Fields)
- [CVE-2024-58255](https://cve.now/CVE-2024-58255.md): EnzoH has an OS command injection vulnerability. (CVSS 5.0, Huawei EnzoH-W5611T)
- [CVE-2024-58257](https://cve.now/CVE-2024-58257.md): EnzoH has an OS command injection vulnerability. (CVSS 5.7, Huawei EnzoH-W5611T)
- [CVE-2024-58256](https://cve.now/CVE-2024-58256.md): EnzoH has an OS command injection vulnerability. (CVSS 4.5, Huawei EnzoH-W5611T)
- [CVE-2025-8708](https://cve.now/CVE-2025-8708.md): Antabot White-Jotter com.gm.wj.config.ShiroConfiguration ShiroConfiguration.java CookieRememberMeManager deserialization (CVSS 2.3, Antabot White-Jotter)
- [CVE-2025-8707](https://cve.now/CVE-2025-8707.md): Huuge Box App com.huuge.game.zjbox AndroidManifest.xml improper export of android application components (CVSS 4.8, Huuge Box App)
- [CVE-2025-8706](https://cve.now/CVE-2025-8706.md): Wanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module CreateFunctionLog sql injection (CVSS 5.3, Wanzhou WOES Intelligent Optimization Energy Saving System)
- [CVE-2025-8705](https://cve.now/CVE-2025-8705.md): Wanzhou WOES Intelligent Optimization Energy Saving System Energy Overview Module GetTargetConfig sql injection (CVSS 5.3, Wanzhou WOES Intelligent Optimization Energy Saving System)
- [CVE-2025-8704](https://cve.now/CVE-2025-8704.md): Wanzhou WOES Intelligent Optimization Energy Saving System Analysis Conclusion Query Module GetAlarmResultProcessList sql injection (CVSS 5.3, Wanzhou WOES Intelligent Optimization Energy Saving System)
- [CVE-2025-54887](https://cve.now/CVE-2025-54887.md): jwe: Missing AES-GCM authentication tag validation in encrypted JWEs (CVSS 9.1, jwt ruby-jwe · jwe)
- [CVE-2025-54886](https://cve.now/CVE-2025-54886.md): skops: Card.get\_model does not block arbitrary code execution (CVSS 8.4, skops-dev skops · skops)
- [CVE-2025-54793](https://cve.now/CVE-2025-54793.md): Astro: Duplicate trailing slash feature can lead to Open Redirects (CVSS 5.5, withastro astro · astro)
- [CVE-2025-8703](https://cve.now/CVE-2025-8703.md): Wanzhou WOES Intelligent Optimization Energy Saving System Environmental Real-Time Data Module GetAreaTrendChartData sql injection (CVSS 5.3, Wanzhou WOES Intelligent Optimization Energy Saving System)
- [CVE-2025-54368](https://cve.now/CVE-2025-54368.md): uv is vulnerable to ZIP payload obfuscation through parsing differentials (CVSS 6.8, astral-sh uv · uv)
- [CVE-2020-9322](https://cve.now/CVE-2020-9322.md): The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. (CVSS 8.8)
- [CVE-2025-50465](https://cve.now/CVE-2025-50465.md): OpenMetadata \<=1.4.4 is vulnerable to SQL Injection. (CVSS 7.1)
- [CVE-2025-50466](https://cve.now/CVE-2025-50466.md): OpenMetadata \<=1.4.4 is vulnerable to SQL Injection. (CVSS 7.1)
- [CVE-2025-50467](https://cve.now/CVE-2025-50467.md): OpenMetadata \<=1.4.4 is vulnerable to SQL Injection. (CVSS 6.5)
- [CVE-2025-50468](https://cve.now/CVE-2025-50468.md): OpenMetadata \<=1.4.4 is vulnerable to SQL Injection. (CVSS 6.5)
- [CVE-2025-50927](https://cve.now/CVE-2025-50927.md): A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to (CVSS 6.3)
- [CVE-2025-50928](https://cve.now/CVE-2025-50928.md): Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settin (CVSS 4.8)
- [CVE-2025-52913](https://cve.now/CVE-2025-52913.md): A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated (CVSS 9.8)
- [CVE-2025-52914](https://cve.now/CVE-2025-52914.md): A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticate (CVSS 8.8)
- [CVE-2025-55188](https://cve.now/CVE-2025-55188.md): 7-Zip before 25.01 does not always properly handle symbolic links during extraction. (CVSS 3.6, 7-Zip)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.