# CVEs published 2025-08-09

41 CVEs were published on August 9, 2025: 1 critical, 8 high. Days are UTC.

- [CVE-2025-8785](https://cve.now/CVE-2025-8785.md): Portabilis i-Educar educar\_usuario\_lst.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-8784](https://cve.now/CVE-2025-8784.md): Portabilis i-Educar Cadastrar Vínculo funcionario\_vinculo\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-8775](https://cve.now/CVE-2025-8775.md): Qiyuesuo Eelectronic Signature Platform Scheduled Task upload execute unrestricted upload (CVSS 5.3, Qiyuesuo Eelectronic Signature Platform)
- [CVE-2025-8774](https://cve.now/CVE-2025-8774.md): riscv-boom SonicBOOM L1 Data Cache timing discrepancy (CVSS 2.0, riscv-boom SonicBOOM)
- [CVE-2025-8773](https://cve.now/CVE-2025-8773.md): Dinstar Monitoring Platform 甘肃省危险品库监控平台 login\_getPasswordErrorNum.action sql injection (CVSS 6.9, Dinstar Monitoring Platform 甘肃省危险品库监控平台)
- [CVE-2025-8772](https://cve.now/CVE-2025-8772.md): Vinades NukeViet Module index.php server-side request forgery (CVSS 5.3, Vinades NukeViet)
- [CVE-2025-8765](https://cve.now/CVE-2025-8765.md): Datacom DM955 5GT 1200 Wireless Basic Settings cross site scripting (CVSS 5.1, Datacom DM955 5GT)
- [CVE-2025-8764](https://cve.now/CVE-2025-8764.md): linlinjava litemall upload unrestricted upload (CVSS 5.3, linlinjava litemall)
- [CVE-2025-8763](https://cve.now/CVE-2025-8763.md): Ruijie EG306MG strongSwan strongswan.conf missing encryption (CVSS 6.3, Ruijie EG306MG)
- [CVE-2025-8759](https://cve.now/CVE-2025-8759.md): TRENDnet TN-200 Lighttpd hard-coded key (CVSS 6.3, TRENDnet TN-200)
- [CVE-2025-8758](https://cve.now/CVE-2025-8758.md): TRENDnet TEW-822DRE vsftpd least privilege violation (CVSS 7.3, TRENDnet TEW-822DRE)
- [CVE-2025-8757](https://cve.now/CVE-2025-8757.md): TRENDnet TV-IP110WN Embedded Boa Web Server boa.conf least privilege violation (CVSS 7.3, TRENDnet TV-IP110WN)
- [CVE-2025-8756](https://cve.now/CVE-2025-8756.md): TDuckCloud tduck-platform manage preHandle improper authorization (CVSS 5.3, TDuckCloud tduck-platform)
- [CVE-2024-58238](https://cve.now/CVE-2024-58238.md): Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (CVSS 7.1, Linux)
- [CVE-2022-50233](https://cve.now/CVE-2022-50233.md): Bluetooth: eir: Fix using strlen with hdev-\>{dev\_name,short\_name} (CVSS 7.8, Linux)
- [CVE-2025-8755](https://cve.now/CVE-2025-8755.md): macrozheng mall com.macro.mall.portal.controller UmsMemberController.java detail authorization (CVSS 6.9, macrozheng mall)
- [CVE-2025-7726](https://cve.now/CVE-2025-7726.md): The7 \<= 12.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title and data-dt-img-description Attributes (CVSS 6.4, Dream-Theme The7 — Website and eCommerce Builder for WordPr…)
- [CVE-2025-8753](https://cve.now/CVE-2025-8753.md): linlinjava litemall File delete path traversal (CVSS 5.3, linlinjava litemall)
- [CVE-2025-7020](https://cve.now/CVE-2025-7020.md): BYD DiLink OS Incorrect encryption Implementation of system log dumps (CVSS 5.1, BYD DiLink OS)
- [CVE-2025-8752](https://cve.now/CVE-2025-8752.md): wangzhixuan spring-shiro-training add command injection (CVSS 6.9, wangzhixuan spring-shiro-training)
- [CVE-2025-8751](https://cve.now/CVE-2025-8751.md): Protected Total WebShield Extension Block Page cross site scripting (CVSS 2.3, Protected Total WebShield Extension)
- [CVE-2025-8750](https://cve.now/CVE-2025-8750.md): macrozheng mall Add Product Page upload cross site scripting (CVSS 4.8, macrozheng mall)
- [CVE-2025-8746](https://cve.now/CVE-2025-8746.md): GNU libopts \_\_strstr\_sse2 memory corruption (CVSS 4.8, GNU libopts)
- [CVE-2025-8745](https://cve.now/CVE-2025-8745.md): Weee RICEPO App com.ricepo.app AndroidManifest.xml improper export of android application components (CVSS 4.8, Weee RICEPO App)
- [CVE-2025-4655](https://cve.now/CVE-2025-4655.md): SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 (CVSS 5.1, Liferay Portal · Liferay DXP +2)
- [CVE-2025-4581](https://cve.now/CVE-2025-4581.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3, Liferay Portal · Liferay DXP +2)
- [CVE-2025-55149](https://cve.now/CVE-2025-55149.md): Path Traversal Vulnerability in PDF Review Function (CWE-22) (CVSS 6.7, ulab-uiuc tiny-scientist · tiny-scientist)
- [CVE-2025-55013](https://cve.now/CVE-2025-55013.md): Assemblyline 4 Service Client: Arbitrary Write through path traversal in Client code (CVSS 4.2, CybercentreCanada assemblyline · assemblyline-service-client)
- [CVE-2025-55008](https://cve.now/CVE-2025-55008.md): AuthKit React Router: Sensitive auth data rendered in HTML (CVSS 7.1, workos authkit-react-router · @workos-inc/authkit-react-rou…)
- [CVE-2025-55009](https://cve.now/CVE-2025-55009.md): AuthKit: Sensitive auth data rendered in HTML (CVSS 7.1, workos authkit-remix · @workos-inc/authkit-remix)
- [CVE-2025-55006](https://cve.now/CVE-2025-55006.md): Frappe Learning Holds Potential for Malicious SVG Upload in Image Upload Feature (CVSS 4.3, frappe lms)
- [CVE-2025-55003](https://cve.now/CVE-2025-55003.md): OpenBao Login MFA Bypasses Rate Limiting and TOTP Token Reuse (CVSS 5.7, openbao · github.com/openbao/openbao)
- [CVE-2025-55001](https://cve.now/CVE-2025-55001.md): OpenBao LDAP MFA Enforcement Bypass When Using Username As Alias (CVSS 6.5, openbao · github.com/openbao/openbao)
- [CVE-2025-55000](https://cve.now/CVE-2025-55000.md): OpenBao TOTP Secrets Engine Enables Code Reuse (CVSS 6.5, openbao · github.com/openbao/openbao)
- [CVE-2025-54999](https://cve.now/CVE-2025-54999.md): OpenBao: Timing Side-Channel in Userpass Auth Method (CVSS 3.7, openbao · github.com/openbao/openbao)
- [CVE-2025-54998](https://cve.now/CVE-2025-54998.md): OpenBao Userpass and LDAP User Lockout Bypass (CVSS 5.3, openbao · github.com/openbao/openbao)
- [CVE-2025-54997](https://cve.now/CVE-2025-54997.md): OpenBao: Privileged Operator May Execute Code on the Underlying Host (CVSS 9.1, openbao · github.com/openbao/openbao)
- [CVE-2025-54996](https://cve.now/CVE-2025-54996.md): OpenBao Root Namespace Operator May Elevate Token Privileges (CVSS 7.2, openbao · github.com/openbao/openbao)
- [CVE-2025-54888](https://cve.now/CVE-2025-54888.md): @fedify/fedify: Improper Authentication and Incorrect Authorization (CVSS 8.7, fedify-dev fedify · @fedify/fedify)
- [CVE-2025-54417](https://cve.now/CVE-2025-54417.md): Craft contains a theoretical bypass for CVE-2025-23209 (CVSS 5.2, craftcms cms · craftcms/cms)
- [CVE-2025-55152](https://cve.now/CVE-2025-55152.md): oak: ReDoS in x-forwarded-proto and x-forwarded-for headers (CVSS 5.3, oakserver oak · @oakserver/oak)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.