# CVEs published 2025-08-14

310 CVEs were published on August 14, 2025: 22 critical, 102 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-8989](https://cve.now/CVE-2025-8989.md): SourceCodester COVID 19 Testing Management System edit-phlebotomist.php sql injection (CVSS 6.9, SourceCodester COVID 19 Testing Management System)
- [CVE-2025-8988](https://cve.now/CVE-2025-8988.md): SourceCodester COVID 19 Testing Management System bwdates-report-result.php sql injection (CVSS 6.9, SourceCodester COVID 19 Testing Management System)
- [CVE-2025-8987](https://cve.now/CVE-2025-8987.md): SourceCodester COVID 19 Testing Management System test-details.php sql injection (CVSS 6.9, SourceCodester COVID 19 Testing Management System)
- [CVE-2025-31987](https://cve.now/CVE-2025-31987.md): HCL Connections Docs is vulnerable to a Denial of Service (DoS) attack (CVSS 4.8, HCL Software Connections Docs)
- [CVE-2025-8986](https://cve.now/CVE-2025-8986.md): SourceCodester COVID 19 Testing Management System search-report-result.php sql injection (CVSS 6.9, SourceCodester COVID 19 Testing Management System)
- [CVE-2025-8985](https://cve.now/CVE-2025-8985.md): SourceCodester COVID 19 Testing Management System profile.php sql injection (CVSS 6.9, SourceCodester COVID 19 Testing Management System)
- [CVE-2025-8984](https://cve.now/CVE-2025-8984.md): itsourcecode Online Tour and Travel Management System expense\_category.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-8983](https://cve.now/CVE-2025-8983.md): itsourcecode Online Tour and Travel Management System expense.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-8982](https://cve.now/CVE-2025-8982.md): itsourcecode Online Tour and Travel Management System currency.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-8981](https://cve.now/CVE-2025-8981.md): itsourcecode Online Tour and Travel Management System payment.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-8980](https://cve.now/CVE-2025-8980.md): Tenda G1 Firmware Update check\_upload\_file data authenticity (CVSS 7.5, Tenda G1)
- [CVE-2025-8979](https://cve.now/CVE-2025-8979.md): Tenda AC15 Firmware Update check\_fw data authenticity (CVSS 7.5, Tenda AC15)
- [CVE-2025-8978](https://cve.now/CVE-2025-8978.md): D-Link DIR-619L boa FirmwareUpgrade data authenticity (CVSS 7.5, D-Link DIR-619L)
- [CVE-2025-8976](https://cve.now/CVE-2025-8976.md): givanz Vvveb Endpoint post cross site scripting (CVSS 5.1, givanz Vvveb)
- [CVE-2025-8975](https://cve.now/CVE-2025-8975.md): givanz Vvveb edit.tpl cross site scripting (CVSS 5.1, givanz Vvveb)
- [CVE-2025-52765](https://cve.now/CVE-2025-52765.md): WordPress NetInsight Analytics Implementation Plugin \<= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, lisensee NetInsight Analytics Implementation Plugin)
- [CVE-2025-52767](https://cve.now/CVE-2025-52767.md): WordPress NetInsight Analytics Implementation Plugin \<= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, lisensee NetInsight Analytics Implementation Plugin)
- [CVE-2025-52769](https://cve.now/CVE-2025-52769.md): WordPress flexo-social-gallery Plugin \<= 1.0006 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, flexostudio flexo-social-gallery)
- [CVE-2025-52771](https://cve.now/CVE-2025-52771.md): WordPress Video Expander Plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, bcupham Video Expander)
- [CVE-2025-52797](https://cve.now/CVE-2025-52797.md): WordPress StoryMap Plugin \<= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.2, josepsitjar StoryMap)
- [CVE-2025-53219](https://cve.now/CVE-2025-53219.md): WordPress WP-Database-Optimizer-Tools Plugin \<= 0.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, pl4g4 WP-Database-Optimizer-Tools)
- [CVE-2025-53221](https://cve.now/CVE-2025-53221.md): WordPress CodeablePress plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 4.3, CodeablePress)
- [CVE-2025-53241](https://cve.now/CVE-2025-53241.md): WordPress Simplified plugin \<= 1.0.11 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.5, kodeshpa Simplified)
- [CVE-2025-53249](https://cve.now/CVE-2025-53249.md): WordPress Build App Online Plugin \<= 1.0.23 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 6.5, hakeemnala Build App Online)
- [CVE-2025-53330](https://cve.now/CVE-2025-53330.md): WordPress WP Rentals theme \<= 3.16.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WpEstate WP Rentals)
- [CVE-2025-53341](https://cve.now/CVE-2025-53341.md): WordPress Stratus theme \<= 4.2.5 - Broken Access Control vulnerability (CVSS 4.3, Pixel Makers Creative App, SaaS & Software Startup Tech The…)
- [CVE-2025-53342](https://cve.now/CVE-2025-53342.md): WordPress Modernize Theme \<= 3.4.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, GoodLayers Modernize)
- [CVE-2025-53343](https://cve.now/CVE-2025-53343.md): WordPress Modernize Theme \<= 3.4.0 - Broken Access Control Vulnerability (CVSS 4.3, GoodLayers Modernize)
- [CVE-2025-53347](https://cve.now/CVE-2025-53347.md): WordPress Kalium Theme \<= 3.18.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Laborator Kalium)
- [CVE-2025-53575](https://cve.now/CVE-2025-53575.md): WordPress Primer MyData for Woocommerce Plugin \<= 4.2.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, primersoftware Primer MyData for Woocommerce)
- [CVE-2025-53581](https://cve.now/CVE-2025-53581.md): WordPress RSS Feed Pro Plugin \<= 1.1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, artiosmedia RSS Feed Pro)
- [CVE-2025-53582](https://cve.now/CVE-2025-53582.md): WordPress WordLift Plugin \<= 3.54.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WordLift)
- [CVE-2025-53587](https://cve.now/CVE-2025-53587.md): WordPress Findgo Theme \<= 1.3.57 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, ApusTheme Findgo)
- [CVE-2025-54054](https://cve.now/CVE-2025-54054.md): WordPress 12 Step Meeting List Plugin \<= 3.18.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, AA Web Servant 12 Step Meeting List)
- [CVE-2025-54708](https://cve.now/CVE-2025-54708.md): WordPress B Blocks Plugin \<= 2.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, bPlugins B Blocks)
- [CVE-2025-54712](https://cve.now/CVE-2025-54712.md): WordPress Easy Elementor Addons Plugin \<= 2.2.7 - Broken Access Control Vulnerability (CVSS 4.3, hashthemes Easy Elementor Addons)
- [CVE-2025-54715](https://cve.now/CVE-2025-54715.md): WordPress Barcode Scanner with Inventory & Order Manager Plugin \<= 1.9.0 - Arbitrary File Download Vulnerability (CVSS 4.9, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…)
- [CVE-2025-54717](https://cve.now/CVE-2025-54717.md): WordPress WP Membership Plugin \<= 1.6.3 - Settings Change Vulnerability (CVSS 5.4, e-plugins WP Membership)
- [CVE-2025-54727](https://cve.now/CVE-2025-54727.md): WordPress CM On Demand Search And Replace Plugin \<= 1.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, CreativeMindsSolutions CM On Demand Search And Replace)
- [CVE-2025-54728](https://cve.now/CVE-2025-54728.md): WordPress CM On Demand Search And Replace Plugin \<= 1.5.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, CreativeMindsSolutions CM On Demand Search And Replace)
- [CVE-2025-54729](https://cve.now/CVE-2025-54729.md): WordPress Webba Booking Plugin \<= 6.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Webba Appointment Booking Webba Booking)
- [CVE-2025-54730](https://cve.now/CVE-2025-54730.md): WordPress Embedder for Google Reviews Plugin \<= 1.7.3 - Broken Access Control Vulnerability (CVSS 5.3, PARETO Digital Embedder for Google Reviews)
- [CVE-2025-54732](https://cve.now/CVE-2025-54732.md): WordPress WPDM – Premium Packages Plugin \<= 6.0.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Shahjada WPDM – Premium Packages)
- [CVE-2025-54736](https://cve.now/CVE-2025-54736.md): WordPress Savoy Theme \<= 3.0.8 - Sensitive Data Exposure Vulnerability (CVSS 5.3, NordicMade Savoy)
- [CVE-2025-54739](https://cve.now/CVE-2025-54739.md): WordPress Nexter Blocks Plugin \<= 4.5.4 - Broken Access Control Vulnerability (CVSS 5.3, POSIMYTH Nexter Blocks)
- [CVE-2025-54740](https://cve.now/CVE-2025-54740.md): WordPress Print My Blog Plugin \<= 3.27.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Michael Nelson Print My Blog)
- [CVE-2025-54746](https://cve.now/CVE-2025-54746.md): WordPress Shortcode Redirect Plugin \<= 1.0.02 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, cartpauj Shortcode Redirect)
- [CVE-2025-54747](https://cve.now/CVE-2025-54747.md): WordPress Templatera Plugin \<= 2.3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, wpbakery Templatera)
- [CVE-2025-54749](https://cve.now/CVE-2025-54749.md): WordPress JetProductGallery Plugin \<= 2.2.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetProductGallery)
- [CVE-2025-55708](https://cve.now/CVE-2025-55708.md): WordPress Quiz And Survey Master Plugin \<= 10.2.4 - SQL Injection Vulnerability (CVSS 8.5, ExpressTech Systems Quiz And Survey Master)
- [CVE-2025-55709](https://cve.now/CVE-2025-55709.md): WordPress Visual Composer Website Builder Plugin \< 45.15.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Visual Composer Website Builder)
- [CVE-2025-55710](https://cve.now/CVE-2025-55710.md): WordPress TaxoPress Plugin \<= 3.37.2 - Sensitive Data Exposure Vulnerability (CVSS 4.3, Steve Burge TaxoPress)
- [CVE-2025-55711](https://cve.now/CVE-2025-55711.md): WordPress WP Table Builder Plugin \<= 2.0.12 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WP Table Builder)
- [CVE-2025-55712](https://cve.now/CVE-2025-55712.md): WordPress The Plus Addons for Elementor Page Builder Lite Plugin \<= 6.3.13 - Broken Access Control Vulnerability (CVSS 6.5, POSIMYTH The Plus Addons for Elementor Page Builder Lite)
- [CVE-2025-55713](https://cve.now/CVE-2025-55713.md): WordPress Blocksy Theme \<= 2.1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, creativethemeshq Blocksy)
- [CVE-2025-55714](https://cve.now/CVE-2025-55714.md): WordPress JetElements For Elementor Plugin \<= 2.7.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetElements For Elementor)
- [CVE-2025-55716](https://cve.now/CVE-2025-55716.md): WordPress WP Statistics Plugin \<= 14.15 - Broken Access Control Vulnerability (CVSS 4.3, VeronaLabs WP Statistics)
- [CVE-2025-21110](https://cve.now/CVE-2025-21110.md): Dell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. (CVSS 6.7, Dell Data Lakehouse)
- [CVE-2025-8974](https://cve.now/CVE-2025-8974.md): linlinjava litemall JSON Web Token JwtHelper.java hard-coded credentials (CVSS 6.3, linlinjava litemall)
- [CVE-2025-8973](https://cve.now/CVE-2025-8973.md): SourceCodester Cashier Queuing System Actions.php sql injection (CVSS 6.9, SourceCodester Cashier Queuing System)
- [CVE-2025-8972](https://cve.now/CVE-2025-8972.md): itsourcecode Online Tour and Travel Management System page-login.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2024-37945](https://cve.now/CVE-2024-37945.md): WordPress WPBITS Addons For Elementor plugin \<= 1.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPBITS Addons For Elementor Page Builder)
- [CVE-2025-8971](https://cve.now/CVE-2025-8971.md): itsourcecode Online Tour and Travel Management System travellers.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-8970](https://cve.now/CVE-2025-8970.md): itsourcecode Online Tour and Travel Management System booking.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-55192](https://cve.now/CVE-2025-55192.md): HomeAssistant-Tapo-Control Code Injection Vulnerability in issues.yml Workflow (CVSS 8.6, JurajNyiri HomeAssistant-Tapo-Control)
- [CVE-2025-20220](https://cve.now/CVE-2025-20220.md): A vulnerability in the CLI of Cisco Secure Firewall Management Center (FMC) Software and Cisco Secure Firewall Threat Defense (FTD) Software (CVSS 6.0, Cisco Firepower Management Center · Cisco Firepower Threat…)
- [CVE-2025-55195](https://cve.now/CVE-2025-55195.md): @std/toml Prototype Pollution in Node.js and Browser (CVSS 7.3, denoland std)
- [CVE-2025-8969](https://cve.now/CVE-2025-8969.md): itsourcecode Online Tour and Travel Management System approve\_user.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-8968](https://cve.now/CVE-2025-8968.md): itsourcecode Online Tour and Travel Management System disapprove\_user.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-20306](https://cve.now/CVE-2025-20306.md): Cisco Secure Firewall Management Center Software Command Injection Vulnerability (CVSS 4.9, Cisco Firepower Management Center)
- [CVE-2025-20302](https://cve.now/CVE-2025-20302.md): Cisco Secure Firewall Management Center Software Authorization Bypass Vulnerability (CVSS 4.3, Cisco Firepower Management Center)
- [CVE-2025-20301](https://cve.now/CVE-2025-20301.md): Cisco Secure Firewall Management Center Software Authorization Bypass Vulnerability (CVSS 6.5, Cisco Firepower Management Center)
- [CVE-2025-20268](https://cve.now/CVE-2025-20268.md): Cisco Secure Firewall Threat Defense Software Geolocation Remote Access VPN Bypass Vulnerability (CVSS 5.8, Cisco Firepower Threat Defense Software)
- [CVE-2025-20265](https://cve.now/CVE-2025-20265.md): Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability (CVSS 10.0, Cisco Firepower Management Center)
- [CVE-2025-20254](https://cve.now/CVE-2025-20254.md): A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software an (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20263](https://cve.now/CVE-2025-20263.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Buffer Overflow Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20253](https://cve.now/CVE-2025-20253.md): Cisco IOS, IOS XE, Secure Firewall Adaptive Security Appliance, and Secure Firewall Threat Defense Software IKEv2 Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20252](https://cve.now/CVE-2025-20252.md): A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software an (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20251](https://cve.now/CVE-2025-20251.md): Cisco Secure Firewall Adaptive Security Appliance and Cisco Secure Firewall Threat Defense Software Authenticated Arbitrary File Deletion (CVSS 8.5, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20244](https://cve.now/CVE-2025-20244.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access VPN Web Server Denial of Service Vulnerability (CVSS 7.7, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20243](https://cve.now/CVE-2025-20243.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20239](https://cve.now/CVE-2025-20239.md): A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Secu (CVSS 8.6, Cisco IOS · Cisco Adaptive Security Appliance (ASA) Soft… +1)
- [CVE-2025-20237](https://cve.now/CVE-2025-20237.md): A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software (CVSS 6.0, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20238](https://cve.now/CVE-2025-20238.md): A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software (CVSS 6.0, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20225](https://cve.now/CVE-2025-20225.md): A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Secu (CVSS 5.8, Cisco IOS · Cisco Adaptive Security Appliance (ASA) Soft… +1)
- [CVE-2025-20235](https://cve.now/CVE-2025-20235.md): Cisco Secure Firewall Management Center Software Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Firepower Management Center)
- [CVE-2025-20224](https://cve.now/CVE-2025-20224.md): A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software an (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20222](https://cve.now/CVE-2025-20222.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Buffer Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2025-20219](https://cve.now/CVE-2025-20219.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Access Control Bypass Vulnerability (CVSS 5.3, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20218](https://cve.now/CVE-2025-20218.md): Cisco Secure Firepower Management Center Software XPATH Injection Vulnerability (CVSS 4.9, Cisco Firepower Management Center)
- [CVE-2025-20217](https://cve.now/CVE-2025-20217.md): Cisco Firepower Threat Defense Intrusion Detection Denial of Service Vulnerability (CVSS 8.6, Cisco Firepower Threat Defense Software)
- [CVE-2025-20148](https://cve.now/CVE-2025-20148.md): Cisco Secure Firewall Management Center HTML Injection Vulnerability (CVSS 8.5, Cisco Firepower Management Center)
- [CVE-2025-20136](https://cve.now/CVE-2025-20136.md): Cisco Adaptive Security Appliance and Firepower Threat Defense Software Network Address Translation DNS Inspection Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20135](https://cve.now/CVE-2025-20135.md): Cisco Adaptive Security Appliance and Firepower Threat Defense Software DHCP Denial of Service Vulnerability (CVSS 4.3, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20127](https://cve.now/CVE-2025-20127.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software for Firepower 3100 and 4200 Series TLS Cipher Denial of Service Vulnerability (CVSS 7.7, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20133](https://cve.now/CVE-2025-20133.md): Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Authentication Targeted Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-20134](https://cve.now/CVE-2025-20134.md): Cisco Adaptive Security Appliance and Firepower Threat Defense Software SSL/TLS Certificate Denial of Service Vulnerability (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2025-9043](https://cve.now/CVE-2025-9043.md): The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploit (CVSS 6.7, Seagate Toolkit)
- [CVE-2025-9039](https://cve.now/CVE-2025-9039.md): Information Disclosure in Amazon ECS Container Agent (CVSS 5.3, Amazon ECS · github.com/aws/amazon-ecs-agent)
- [CVE-2025-54867](https://cve.now/CVE-2025-54867.md): Youki Symlink Following Vulnerability (CVSS 7.0, youki-dev youki · youki)
- [CVE-2025-8967](https://cve.now/CVE-2025-8967.md): itsourcecode Online Tour and Travel Management System packages.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-54389](https://cve.now/CVE-2025-54389.md): AIDE improper output neutralization vulnerability (CVSS 6.2, aide)
- [CVE-2025-54409](https://cve.now/CVE-2025-54409.md): AIDE null pointer dereference when reading incorrectly encoded xattr attributes from database (local DoS) (CVSS 6.2, aide)
- [CVE-2025-33142](https://cve.now/CVE-2025-33142.md): IBM WebSphere Application Server information disclosure (CVSS 5.3, IBM WebSphere Application Server)
- [CVE-2025-36047](https://cve.now/CVE-2025-36047.md): IBM WebSphere Application Server Liberty denial of service (CVSS 5.3, IBM WebSphere Application Server Liberty)
- [CVE-2025-8966](https://cve.now/CVE-2025-8966.md): itsourcecode Online Tour and Travel Management System tax.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-8965](https://cve.now/CVE-2025-8965.md): linlinjava litemall Endpoint AdminStorageController.java create unrestricted upload (CVSS 5.3, linlinjava litemall)
- [CVE-2025-53631](https://cve.now/CVE-2025-53631.md): flaskBlog XSS Vulnerability in postContent (CVSS 5.3, DogukanUrker flaskBlog)
- [CVE-2025-40758](https://cve.now/CVE-2025-40758.md): A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions \< V4.0.3), Mendix SAML (Mendix 10.21 compatible) (CVSS 8.7, Siemens Mendix SAML)
- [CVE-2025-8964](https://cve.now/CVE-2025-8964.md): code-projects Hostel Management System Login hostel\_manage.exe improper authentication (CVSS 4.8, code-projects Hostel Management System)
- [CVE-2025-7971](https://cve.now/CVE-2025-7971.md): Studio 5000 Logix Designer® – Arbitrary Code Execution Vulnerability (CVSS 7.3, Rockwell Automation Studio 5000 Logix Designer®)
- [CVE-2025-8875](https://cve.now/CVE-2025-8875.md): Insecure Deserialization Vulnerability (CVSS 9.4, KEV, N-able N-central)
- [CVE-2025-8876](https://cve.now/CVE-2025-8876.md): Command Injection Vulnerability (CVSS 9.4, KEV, N-able N-central)
- [CVE-2025-7972](https://cve.now/CVE-2025-7972.md): Rockwell Automation FactoryTalk® Linx Network Browser Security Bypass Vulnerability (CVSS 8.4, Rockwell Automation FactoryTalk® Linx)
- [CVE-2025-36613](https://cve.now/CVE-2025-36613.md): SupportAssist for Home PCs versions 4.6.3 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain(s) an Incorrect Pri (CVSS 2.8, Dell SupportAssist for Home PCs)
- [CVE-2025-36612](https://cve.now/CVE-2025-36612.md): SupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. (CVSS 6.7, Dell SupportAssist for Business PCs)
- [CVE-2025-38738](https://cve.now/CVE-2025-38738.md): SupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in the (CVSS 6.7, Dell SupportAssist for Home PCs)
- [CVE-2025-8962](https://cve.now/CVE-2025-8962.md): code-projects Hostel Management System Login Form hostel\_manage.exe stack-based overflow (CVSS 4.8, code-projects Hostel Management System)
- [CVE-2025-38745](https://cve.now/CVE-2025-38745.md): Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in (CVSS 4.8, Dell OpenManage Enterprise)
- [CVE-2025-26484](https://cve.now/CVE-2025-26484.md): Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. (CVSS 5.5, Dell CloudLink)
- [CVE-2025-9042](https://cve.now/CVE-2025-9042.md): Rockwell Automation FLEX 5000 I/O - Module Fault (CVSS 8.7, Rockwell Automation FLEX 5000 I/O)
- [CVE-2025-9041](https://cve.now/CVE-2025-9041.md): Rockwell Automation FLEX 5000 I/O - Module Fault (CVSS 8.7, Rockwell Automation FLEX 5000 I/O)
- [CVE-2025-36581](https://cve.now/CVE-2025-36581.md): Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability (CVSS 3.8, Dell PowerEdge)
- [CVE-2025-7973](https://cve.now/CVE-2025-7973.md): Rockwell Automation FactoryTalk® ViewPoint Privilege Escalation Vulnerability (CVSS 8.5, Rockwell Automation FactoryTalk® ViewPoint)
- [CVE-2025-7773](https://cve.now/CVE-2025-7773.md): Rockwell Automation ArmorBlock 5000 I/O – Web Server Vulnerabilities (CVSS 8.8, Rockwell Automation 5032-CFGB16M12P5DR · Rockwell Automa… +1)
- [CVE-2025-7774](https://cve.now/CVE-2025-7774.md): Rockwell Automation ArmorBlock 5000 I/O – Web Server Vulnerabilities (CVSS 8.8, Rockwell Automation 5032-CFGB16M12P5DR · Rockwell Automa… +1)
- [CVE-2025-9036](https://cve.now/CVE-2025-9036.md): Rockwell Automation FactoryTalk® Action Manager v1.0.0 Runtime Vulnerability (CVSS 8.5, Rockwell Automation FactoryTalk® Action Manager)
- [CVE-2025-7353](https://cve.now/CVE-2025-7353.md): Rockwell Automation ControlLogix® Ethernet Remote Code Execution Vulnerability (CVSS 9.3, Rockwell Automation 1756-EN2T/D · Rockwell Automation 17… +3)
- [CVE-2025-55675](https://cve.now/CVE-2025-55675.md): Apache Superset: Incorrect datasource authorization on REST API (CVSS 5.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2025-55674](https://cve.now/CVE-2025-55674.md): Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions (CVSS 5.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2025-55672](https://cve.now/CVE-2025-55672.md): Apache Superset: Stored XSS on charts metadata (CVSS 5.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2025-55673](https://cve.now/CVE-2025-55673.md): Apache Superset: Metadata exposure in embedded charts (CVSS 5.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2025-8963](https://cve.now/CVE-2025-8963.md): jeecgboot JimuReport Data Large Screen Template testConnection deserialization (CVSS 5.3, jeecgboot JimuReport)
- [CVE-2025-8715](https://cve.now/CVE-2025-8715.md): PostgreSQL pg\_dump newline in object name executes arbitrary code in psql client and in restore target server (CVSS 8.8, PostgreSQL)
- [CVE-2025-8714](https://cve.now/CVE-2025-8714.md): PostgreSQL pg\_dump lets superuser of origin server execute arbitrary code in psql client (CVSS 8.8, PostgreSQL)
- [CVE-2025-8713](https://cve.now/CVE-2025-8713.md): PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table (CVSS 3.1, PostgreSQL)
- [CVE-2025-8961](https://cve.now/CVE-2025-8961.md): LibTIFF tiffcrop tiffcrop.c main memory corruption (CVSS 4.8, LibTIFF)
- [CVE-2025-8960](https://cve.now/CVE-2025-8960.md): Campcodes Online Flight Booking Management System save\_airlines.php sql injection (CVSS 6.9, Campcodes Online Flight Booking Management System)
- [CVE-2025-8958](https://cve.now/CVE-2025-8958.md): Tenda TX3 fast\_setting\_wifi\_set stack-based overflow (CVSS 8.7, Tenda TX3)
- [CVE-2025-54707](https://cve.now/CVE-2025-54707.md): WordPress MDTF Plugin \<= 1.3.3.7 - SQL Injection Vulnerability (CVSS 9.3, RealMag777 MDTF)
- [CVE-2025-54706](https://cve.now/CVE-2025-54706.md): WordPress Magical Posts Display Plugin plugin \<= 1.2.52 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Noor Alam Magical Posts Display)
- [CVE-2025-54705](https://cve.now/CVE-2025-54705.md): WordPress WpEvently plugin \<= 4.4.6 - Broken Access Control vulnerability (CVSS 4.3, magepeopleteam WpEvently)
- [CVE-2025-54704](https://cve.now/CVE-2025-54704.md): WordPress Easy Elementor Addons plugin \<= 2.2.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, hashthemes Easy Elementor Addons)
- [CVE-2025-54703](https://cve.now/CVE-2025-54703.md): WordPress Integrate Google Drive plugin \<= 1.5.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, princeahmed Integrate Google Drive)
- [CVE-2025-54702](https://cve.now/CVE-2025-54702.md): WordPress Ebook Store Plugin plugin \<= 5.8013 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, motov.net Ebook Store)
- [CVE-2025-54701](https://cve.now/CVE-2025-54701.md): WordPress Unicamp Theme \<= 2.6.3 - Local File Inclusion Vulnerability (CVSS 8.1, ThemeMove Unicamp)
- [CVE-2025-54700](https://cve.now/CVE-2025-54700.md): WordPress Makeaholic Theme \<= 1.8.4 - Local File Inclusion Vulnerability (CVSS 8.1, ThemeMove Makeaholic)
- [CVE-2025-54699](https://cve.now/CVE-2025-54699.md): WordPress Masteriyo - LMS Plugin plugin \<= 1.18.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Masteriyo - LMS)
- [CVE-2025-54698](https://cve.now/CVE-2025-54698.md): WordPress Classified Listing Plugin plugin \<= 5.0.0 - Content Injection Vulnerability (CVSS 5.4, RadiusTheme Classified Listing)
- [CVE-2025-54697](https://cve.now/CVE-2025-54697.md): WordPress Kadence WooCommerce Email Designer Plugin \<= 1.5.16 - Privilege Escalation Vulnerability (CVSS 7.2, StellarWP Kadence WooCommerce Email Designer)
- [CVE-2025-54696](https://cve.now/CVE-2025-54696.md): WordPress WPFunnels plugin \<= 3.5.26 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPFunnels)
- [CVE-2025-54695](https://cve.now/CVE-2025-54695.md): WordPress HT Mega Plugin plugin \<= 2.9.0 - Broken Access Control Vulnerability (CVSS 5.4, DevItems HT Mega)
- [CVE-2025-54694](https://cve.now/CVE-2025-54694.md): WordPress Button Block Plugin plugin \<= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, bPlugins Button Block)
- [CVE-2025-54693](https://cve.now/CVE-2025-54693.md): WordPress Form Block Plugin \<= 1.5.5 - Arbitrary File Upload Vulnerability (CVSS 9.0, epiphyt Form Block)
- [CVE-2025-54692](https://cve.now/CVE-2025-54692.md): WordPress Membership For WooCommerce Plugin \<= 2.9.0 - Broken Access Control Vulnerability (CVSS 7.5, WP Swings Membership For WooCommerce)
- [CVE-2025-54691](https://cve.now/CVE-2025-54691.md): WordPress Motors Plugin plugin \<= 1.4.80 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 5.3, Stylemix Motors)
- [CVE-2025-54690](https://cve.now/CVE-2025-54690.md): WordPress Xinterio Theme \<= 4.2 - Local File Inclusion Vulnerability (CVSS 8.1, themeStek Xinterio)
- [CVE-2025-54689](https://cve.now/CVE-2025-54689.md): WordPress Urna Theme \<= 2.5.7 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Urna)
- [CVE-2025-54688](https://cve.now/CVE-2025-54688.md): WordPress JetEngine Plugin plugin \<= 3.7.1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetEngine)
- [CVE-2025-54687](https://cve.now/CVE-2025-54687.md): WordPress JetTabs Plugin plugin \<= 2.2.9.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetTabs)
- [CVE-2025-54686](https://cve.now/CVE-2025-54686.md): WordPress Exertio Theme \<= 1.3.2 - PHP Object Injection Vulnerability (CVSS 9.8, scriptsbundle Exertio)
- [CVE-2025-54685](https://cve.now/CVE-2025-54685.md): WordPress SureDash Plugin \<= 1.1.0 - Sensitive Data Exposure Vulnerability (CVSS 6.5, Brainstorm Force SureDash)
- [CVE-2025-54684](https://cve.now/CVE-2025-54684.md): WordPress Integration for Contact Form 7 and Constant Contact Plugin plugin \<= 1.1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, CRM Perks Integration for Contact Form 7 and Constant Conta…)
- [CVE-2025-54683](https://cve.now/CVE-2025-54683.md): WordPress WP Modal Popup with Cookie Integration Plugin plugin \<= 2.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Astoundify WP Modal Popup with Cookie Integration)
- [CVE-2025-54682](https://cve.now/CVE-2025-54682.md): WordPress Connector for Gravity Forms and Google Sheets Plugin plugin \<= 1.2.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, CRM Perks Connector for Gravity Forms and Google Sheets)
- [CVE-2025-54681](https://cve.now/CVE-2025-54681.md): WordPress Connector for Gravity Forms and Google Sheets Plugin plugin \<= 1.2.4 - Open Redirection Vulnerability (CVSS 4.7, CRM Perks Connector for Gravity Forms and Google Sheets)
- [CVE-2025-54680](https://cve.now/CVE-2025-54680.md): WordPress Blogger Buzz Theme theme \<= 1.2.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, sparklewpthemes Blogger Buzz)
- [CVE-2025-54679](https://cve.now/CVE-2025-54679.md): WordPress Neon Channel Product Customizer Free Plugin \<= 2.0 - Arbitrary Content Deletion Vulnerability (CVSS 7.5, vertim Neon Channel Product Customizer Free)
- [CVE-2025-54678](https://cve.now/CVE-2025-54678.md): WordPress Easy Form Builder Plugin \<= 3.8.15 - SQL Injection Vulnerability (CVSS 9.3, hassantafreshi Easy Form Builder)
- [CVE-2025-54676](https://cve.now/CVE-2025-54676.md): WordPress Online Booking & Scheduling Calendar for by vcita Plugin plugin \<= 4.5.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2025-54675](https://cve.now/CVE-2025-54675.md): WordPress YITH WooCommerce Popup Plugin plugin \<= 1.48.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, YITHEMES YITH WooCommerce Popup)
- [CVE-2025-54674](https://cve.now/CVE-2025-54674.md): WordPress Product Configurator for WooCommerce Plugin plugin \<= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, mklacroix Product Configurator for WooCommerce)
- [CVE-2025-54673](https://cve.now/CVE-2025-54673.md): WordPress Chartify plugin \<= 3.5.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Ays Pro Chartify)
- [CVE-2025-54672](https://cve.now/CVE-2025-54672.md): WordPress Photo Engine Plugin plugin \<= 6.4.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Jordy Meow Photo Engine)
- [CVE-2025-54671](https://cve.now/CVE-2025-54671.md): WordPress oik plugin \<= 4.15.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, bobbingwide oik)
- [CVE-2025-54669](https://cve.now/CVE-2025-54669.md): WordPress MapSVG Plugin \< 8.7.4 - SQL Injection Vulnerability (CVSS 9.3, RomanCode MapSVG)
- [CVE-2025-54668](https://cve.now/CVE-2025-54668.md): WordPress myCred plugin \<= 2.9.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Saad Iqbal myCred)
- [CVE-2025-54667](https://cve.now/CVE-2025-54667.md): WordPress myCred plugin \<= 2.9.4.3 - Race Condition Vulnerability (CVSS 5.3, Saad Iqbal myCred)
- [CVE-2025-3703](https://cve.now/CVE-2025-3703.md): WordPress CSS & JavaScript Toolbox plugin \< 12.0.3 - Local File Inclusion vulnerability (CVSS 7.5, wipeoutmedia CSS & JavaScript Toolbox)
- [CVE-2025-24766](https://cve.now/CVE-2025-24766.md): WordPress News Magazine X \<= 1.2.35 - Local File Inclusion Vulnerability (CVSS 7.5, wproyal News Magazine X)
- [CVE-2025-24775](https://cve.now/CVE-2025-24775.md): WordPress Forms \<= 2.9.0 - Arbitrary File Upload Vulnerability (CVSS 9.9, Made I.T. Forms)
- [CVE-2025-25172](https://cve.now/CVE-2025-25172.md): WordPress VidMov \<= 1.9.4 - Local File Inclusion Vulnerability (CVSS 8.1, beeteam368 VidMov)
- [CVE-2025-25174](https://cve.now/CVE-2025-25174.md): WordPress BeeTeam368 Extensions Plugin \<= 1.9.4 - Local File Inclusion Vulnerability (CVSS 10.0, BeeTeam368 Extensions)
- [CVE-2025-28962](https://cve.now/CVE-2025-28962.md): WordPress Advanced Google Universal Analytics plugin \<= 1.0.3 - Broken Access Control to Sensitive Data Exposure vulnerability (CVSS 6.5, stefanoai Advanced Google Universal Analytics)
- [CVE-2025-28975](https://cve.now/CVE-2025-28975.md): WordPress Alike - WordPress Custom Post Comparison \<= 3.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, redqteam Alike - WordPress Custom Post Comparison)
- [CVE-2025-28979](https://cve.now/CVE-2025-28979.md): WordPress WP Pipes \<= 1.4.3 - Local File Inclusion Vulnerability (CVSS 8.1, ThimPress WP Pipes)
- [CVE-2025-28987](https://cve.now/CVE-2025-28987.md): WordPress PressForward \<= 5.9.4 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, PressForward)
- [CVE-2025-28999](https://cve.now/CVE-2025-28999.md): WordPress WooCommerce Shop Page Builder \<= 2.27.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, ZoomIt WooCommerce Shop Page Builder)
- [CVE-2025-29014](https://cve.now/CVE-2025-29014.md): WordPress FoodMenu \<= 1.20 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, ZoomIt FoodMenu)
- [CVE-2025-30626](https://cve.now/CVE-2025-30626.md): WordPress Multimedia Playlist Slider Addon for WPBakery Page Builder \<= 2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Multimedia Playlist Slider Addon for WPBakery…)
- [CVE-2025-30635](https://cve.now/CVE-2025-30635.md): WordPress IDonatePro \<= 2.1.9 - Local File Inclusion Vulnerability (CVSS 8.1, ThemeAtelier IDonatePro)
- [CVE-2025-30639](https://cve.now/CVE-2025-30639.md): WordPress IDonatePro Plugin \<= 2.1.9 - Broken Access Control Vulnerability (CVSS 7.5, ThemeAtelier IDonatePro)
- [CVE-2025-30993](https://cve.now/CVE-2025-30993.md): WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales \<= 1.1.7 - Broken Access Control Vulnerability (CVSS 6.5, VillaTheme Thank You Page Customizer for WooCommerce)
- [CVE-2025-30998](https://cve.now/CVE-2025-30998.md): WordPress WP Links Page plugin \<= 4.9.6 - SQL Injection vulnerability (CVSS 8.5, Rico Macchi WP Links Page)
- [CVE-2025-31007](https://cve.now/CVE-2025-31007.md): WordPress Billplz Addon for Contact Form 7 Plugin \<= 1.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Alvind Billplz Addon for Contact Form)
- [CVE-2025-31425](https://cve.now/CVE-2025-31425.md): WordPress WP Lead Capturing Pages plugin \< 2.6 - Arbitrary Content Deletion vulnerability (CVSS 7.5, kamleshyadav WP Lead Capturing Pages)
- [CVE-2025-32288](https://cve.now/CVE-2025-32288.md): WordPress RT-Theme 18 | Extensions plugin \<= 2.4 - Local File Inclusion Vulnerability (CVSS 7.5, stmcan RT-Theme 18 | Extensions)
- [CVE-2025-39483](https://cve.now/CVE-2025-39483.md): WordPress Eventer plugin \< 3.9.9.1 - Content Injection vulnerability (CVSS 6.5, imithemes Eventer)
- [CVE-2025-39510](https://cve.now/CVE-2025-39510.md): WordPress Pinterest Automatic Pin plugin \< 4.19.0 - SQL Injection vulnerability (CVSS 8.5, ValvePress Pinterest Automatic Pin)
- [CVE-2025-47536](https://cve.now/CVE-2025-47536.md): WordPress Content Egg plugin \<= 7.0.0 - PHP Object Injection Vulnerability (CVSS 7.2, keywordrush Content Egg)
- [CVE-2025-47610](https://cve.now/CVE-2025-47610.md): WordPress WooCommerce Fortnox Integration \<= 4.5.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Wetail WooCommerce Fortnox Integration)
- [CVE-2025-47689](https://cve.now/CVE-2025-47689.md): WordPress Video Blogster Lite plugin \<= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, johnh10 Video Blogster Lite)
- [CVE-2025-48293](https://cve.now/CVE-2025-48293.md): WordPress Geo Mashup plugin \<= 1.13.16 - Local File Inclusion vulnerability (CVSS 9.8, Dylan Kuhn Geo Mashup)
- [CVE-2025-48332](https://cve.now/CVE-2025-48332.md): WordPress Gutenberg Blocks \<= 3.3.1 - Local File Inclusion Vulnerability (CVSS 7.5, PublishPress Gutenberg Blocks)
- [CVE-2025-49033](https://cve.now/CVE-2025-49033.md): WordPress ProfileGrid plugin \<= 5.9.5.3 - SQL Injection vulnerability (CVSS 8.5, Metagauss ProfileGrid)
- [CVE-2025-49036](https://cve.now/CVE-2025-49036.md): WordPress Premium Addons for KingComposer Plugin \<= 1.1.1 - Local File Inclusion Vulnerability (CVSS 8.1, octagonwebstudio Premium Addons for KingComposer)
- [CVE-2025-49037](https://cve.now/CVE-2025-49037.md): WordPress Authentication and xmlrpc log writer plugin \<= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Federico Rota Authentication and xmlrpc log writer)
- [CVE-2025-49038](https://cve.now/CVE-2025-49038.md): WordPress WP Dynamic Links plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Soflyy WP Dynamic Links)
- [CVE-2025-49044](https://cve.now/CVE-2025-49044.md): WordPress Simple Poll plugin \<= 1.1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, tosend.it Simple Poll)
- [CVE-2025-49047](https://cve.now/CVE-2025-49047.md): WordPress DigitalOcean Spaces Sync plugin \<= 2.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, keeross DigitalOcean Spaces Sync)
- [CVE-2025-49048](https://cve.now/CVE-2025-49048.md): WordPress Inspectlet – User Session Recording and Heatmaps plugin \<= 2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Inspectlet – User Session Recording and Heatmaps)
- [CVE-2025-49051](https://cve.now/CVE-2025-49051.md): WordPress Hide Text Shortcode plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, biscia7 Hide Text Shortcode)
- [CVE-2025-49052](https://cve.now/CVE-2025-49052.md): WordPress Netease Music plugin \<= 3.2.1 - Broken Access Control vulnerability (CVSS 4.3, Dariolee Netease Music)
- [CVE-2025-49053](https://cve.now/CVE-2025-49053.md): WordPress WP Airdrop Manager plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, kadesthemes WP Airdrop Manager)
- [CVE-2025-49054](https://cve.now/CVE-2025-49054.md): WordPress Time Sheets plugin \<= 2.1.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, mrdenny Time Sheets)
- [CVE-2025-49056](https://cve.now/CVE-2025-49056.md): WordPress 多说社会化评论框 Plugin \<= 1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, shen2 多说社会化评论框)
- [CVE-2025-49057](https://cve.now/CVE-2025-49057.md): WordPress WP Voting Plugin \<= 1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Ko Min WP Voting)
- [CVE-2025-49058](https://cve.now/CVE-2025-49058.md): WordPress SoundSt SEO Search plugin \<= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sound Strategies SoundSt SEO Search)
- [CVE-2025-49059](https://cve.now/CVE-2025-49059.md): WordPress CleverReach® WP Plugin \<= 1.5.20 - SQL Injection Vulnerability (CVSS 9.3, CleverReach® WP)
- [CVE-2025-49061](https://cve.now/CVE-2025-49061.md): WordPress Porn Videos Embed plugin \<= 0.9.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, perteus Porn Videos Embed)
- [CVE-2025-49062](https://cve.now/CVE-2025-49062.md): WordPress WP-jScrollPane plugin \<= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, cornfeed WP-jScrollPane)
- [CVE-2025-49063](https://cve.now/CVE-2025-49063.md): WordPress BaiduXZH Submit(百度熊掌号) plugin \<= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, i3geek BaiduXZH Submit)
- [CVE-2025-49064](https://cve.now/CVE-2025-49064.md): WordPress User Language Switch plugin \<= 1.6.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Webilop User Language Switch)
- [CVE-2025-49065](https://cve.now/CVE-2025-49065.md): WordPress Visit Counter Plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, BestiaDurmiente Visit Counter)
- [CVE-2025-49264](https://cve.now/CVE-2025-49264.md): WordPress Cloud SAML SSO - Single Sign On Login \<= 1.0.18 - Local File Inclusion Vulnerability (CVSS 7.5, Cloud Infrastructure Services Cloud SAML SSO - Single Sign…)
- [CVE-2025-49267](https://cve.now/CVE-2025-49267.md): WordPress Frontend Admin by DynamiApps plugin \<= 3.28.3 - SQL Injection vulnerability (CVSS 8.5, Shabti Kaplan Frontend Admin by DynamiApps)
- [CVE-2025-49271](https://cve.now/CVE-2025-49271.md): WordPress GravityWP - Merge Tags \<= 1.4.4 - Local File Inclusion Vulnerability (CVSS 7.5, GravityWP - Merge Tags)
- [CVE-2025-49433](https://cve.now/CVE-2025-49433.md): WordPress Supermalink \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, ThanhD Supermalink)
- [CVE-2025-49437](https://cve.now/CVE-2025-49437.md): WordPress WP LOL Rotation \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, worstguy WP LOL Rotation)
- [CVE-2025-49869](https://cve.now/CVE-2025-49869.md): WordPress Eventin Plugin \<= 4.0.31 - PHP Object Injection Vulnerability (CVSS 8.8, Arraytics Eventin)
- [CVE-2025-49887](https://cve.now/CVE-2025-49887.md): WordPress Product XML Feed Manager for WooCommerce Plugin \<= 2.9.3 - Remote Code Execution (RCE) Vulnerability (CVSS 9.9, WPFactory Product XML Feed Manager for WooCommerce)
- [CVE-2025-50029](https://cve.now/CVE-2025-50029.md): WordPress AI Tools \<= 4.0.7 - Arbitrary Content Deletion Vulnerability (CVSS 6.5, Ashish AI Tools)
- [CVE-2025-50031](https://cve.now/CVE-2025-50031.md): WordPress DB Backup \<= 6.0 - Broken Access Control Vulnerability (CVSS 6.5, syedamirhussain91 DB Backup)
- [CVE-2025-50040](https://cve.now/CVE-2025-50040.md): WordPress CF7 Spreadsheets Plugin \<= 2.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, moshensky CF7 Spreadsheets)
- [CVE-2025-52712](https://cve.now/CVE-2025-52712.md): WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor \<= 1.27.8 - Path Traversal Vulnerability (CVSS 4.2, Post and Page Builder by BoldGrid)
- [CVE-2025-52716](https://cve.now/CVE-2025-52716.md): WordPress WP REST Cache \<= 2025.1.0 - Local File Inclusion Vulnerability (CVSS 7.5, Acato WP REST Cache)
- [CVE-2025-52720](https://cve.now/CVE-2025-52720.md): WordPress Super Store Finder Plugin \<= 7.5 - SQL Injection Vulnerability (CVSS 9.3, highwarden Super Store Finder)
- [CVE-2025-52721](https://cve.now/CVE-2025-52721.md): WordPress Global Gallery Plugin \<= 9.2.3 - Broken Access Control Vulnerability (CVSS 6.5, LCweb Global Gallery)
- [CVE-2025-52728](https://cve.now/CVE-2025-52728.md): WordPress Responsive Posts Carousel WordPress Plugin Plugin \<= 15.0 - Local File Inclusion Vulnerability (CVSS 7.5, WebCodingPlace Responsive Posts Carousel Pro)
- [CVE-2025-52730](https://cve.now/CVE-2025-52730.md): WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin \<= 4.0.24 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, themefunction WordPress Event Manager, Event Calendar and B…)
- [CVE-2025-52731](https://cve.now/CVE-2025-52731.md): WordPress WordPress Event Manager, Event Calendar and Booking Plugin Plugin \<= 4.0.24 - Arbitrary Content Deletion Vulnerability (CVSS 7.5, themefunction WordPress Event Manager, Event Calendar and B…)
- [CVE-2025-52732](https://cve.now/CVE-2025-52732.md): WordPress Google Map Targeting Plugin \<= 1.1.6 - Local File Inclusion Vulnerability (CVSS 8.8, RealMag777 GMap Targeting)
- [CVE-2025-52775](https://cve.now/CVE-2025-52775.md): WordPress Project Cost Calculator Plugin \<= 1.0.0 - Broken Access Control Vulnerability (CVSS 7.1, Ronik@UnlimitedWP Project Cost Calculator)
- [CVE-2025-52785](https://cve.now/CVE-2025-52785.md): WordPress SMM API plugin \<= 6.0.31 - Broken Access Control vulnerability (CVSS 7.1, softnwords SMM API)
- [CVE-2025-52788](https://cve.now/CVE-2025-52788.md): WordPress CaptionPix \<= 1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Russell Jamieson CaptionPix)
- [CVE-2025-52800](https://cve.now/CVE-2025-52800.md): WordPress The E-Commerce ERP \<= 2.1.1.3 - Broken Access Control Vulnerability (CVSS 7.3, Unity Business Technology Pty The E-Commerce ERP)
- [CVE-2025-52801](https://cve.now/CVE-2025-52801.md): WordPress TheBooking Plugin \<= 1.4.4 - Broken Access Control Vulnerability (CVSS 7.3, VonStroheim TheBooking)
- [CVE-2025-52806](https://cve.now/CVE-2025-52806.md): WordPress JobSearch Plugin \< 3.0.8 - Local File Inclusion Vulnerability (CVSS 7.5, eyecix JobSearch)
- [CVE-2025-52820](https://cve.now/CVE-2025-52820.md): WordPress WooCommerce Point Of Sale (POS) \<= 1.4 - SQL Injection Vulnerability (CVSS 8.5, infosoftplugin WooCommerce Point Of Sale)
- [CVE-2025-52823](https://cve.now/CVE-2025-52823.md): WordPress Cube Portfolio Plugin \<= 1.16.8 - SQL Injection Vulnerability (CVSS 8.5, ovatheme Cube Portfolio)
- [CVE-2025-8957](https://cve.now/CVE-2025-8957.md): Campcodes Online Flight Booking Management System flights.php sql injection (CVSS 6.9, Campcodes Online Flight Booking Management System)
- [CVE-2025-8956](https://cve.now/CVE-2025-8956.md): D-Link DIR‑818L ssdpcgi cgibin getenv command injection (CVSS 5.3, D-Link DIR‑818L)
- [CVE-2025-7761](https://cve.now/CVE-2025-7761.md): Reflected XSS in Lepszy BIP (CVSS 5.1, Akcess-Net Lepszy BIP)
- [CVE-2025-8943](https://cve.now/CVE-2025-8943.md): Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers (CVSS 9.8, flowise)
- [CVE-2025-8047](https://cve.now/CVE-2025-8047.md): Multiple Plugins from itayamar - Supply Chain Compromise (CVSS 9.8, disable-right-click-powered-by-pixterme · pixter-image-digi…)
- [CVE-2025-55346](https://cve.now/CVE-2025-55346.md): Unintended dynamic code execution leads to remote code execution by network attackers (CVSS 9.8, flowise)
- [CVE-2025-8955](https://cve.now/CVE-2025-8955.md): PHPGurukul Hospital Management System edit-doctor.php sql injection (CVSS 6.9, PHPGurukul Hospital Management System)
- [CVE-2025-48862](https://cve.now/CVE-2025-48862.md): Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when (CVSS 7.1, Bosch Rexroth AG ctrlX OS - Setup)
- [CVE-2025-48861](https://cve.now/CVE-2025-48861.md): A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract in (CVSS 5.3, Bosch Rexroth AG ctrlX OS - Setup)
- [CVE-2025-48860](https://cve.now/CVE-2025-48860.md): A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote (CVSS 8.0, Bosch Rexroth AG ctrlX OS - Setup)
- [CVE-2025-54472](https://cve.now/CVE-2025-54472.md): Apache bRPC: Redis Parser Remote Denial of Service (CVSS 7.5, Apache Software Foundation Apache bRPC)
- [CVE-2025-8954](https://cve.now/CVE-2025-8954.md): PHPGurukul Hospital Management System doctor-specilization.php sql injection (CVSS 6.9, PHPGurukul Hospital Management System)
- [CVE-2025-8953](https://cve.now/CVE-2025-8953.md): SourceCodester COVID 19 Testing Management System check\_availability.php sql injection (CVSS 6.9, SourceCodester COVID 19 Testing Management System)
- [CVE-2025-5998](https://cve.now/CVE-2025-5998.md): PPWP \< 1.9.11 - Subscriber+ Access Bypass via REST API (CVSS 6.5, PPWP – Password Protect Pages)
- [CVE-2025-8952](https://cve.now/CVE-2025-8952.md): Campcodes Online Flight Booking Management System Login ajax.php sql injection (CVSS 6.9, Campcodes Online Flight Booking Management System)
- [CVE-2025-8951](https://cve.now/CVE-2025-8951.md): PHPGurukul Teachers Record Management System search.php sql injection (CVSS 6.9, PHPGurukul Teachers Record Management System)
- [CVE-2025-8950](https://cve.now/CVE-2025-8950.md): Campcodes Online Recruitment Management System index.php sql injection (CVSS 6.9, Campcodes Online Recruitment Management System)
- [CVE-2025-27388](https://cve.now/CVE-2025-27388.md): Arbitrary URL Loading in WebView Leading to Token Leakage Risk (CVSS 8.3, OPPO HEALTH APP)
- [CVE-2025-8949](https://cve.now/CVE-2025-8949.md): D-Link DIR-825 httpd ping\_response.cgi get\_ping\_app\_stat stack-based overflow (CVSS 8.6, D-Link DIR-825)
- [CVE-2025-8948](https://cve.now/CVE-2025-8948.md): projectworlds Visitor Management System front.php sql injection (CVSS 6.9, projectworlds Visitor Management System)
- [CVE-2025-8947](https://cve.now/CVE-2025-8947.md): projectworlds Visitor Management System query\_data.php sql injection (CVSS 6.9, projectworlds Visitor Management System)
- [CVE-2025-8946](https://cve.now/CVE-2025-8946.md): projectworlds Online Notes Sharing Platform login.php sql injection (CVSS 6.9, projectworlds Online Notes Sharing Platform)
- [CVE-2025-8046](https://cve.now/CVE-2025-8046.md): Injection Guard \< 1.2.8 - Reflected XSS via $\_SERVER\['REQUEST\_URI'\] (CVSS 6.1, Injection Guard)
- [CVE-2025-7808](https://cve.now/CVE-2025-7808.md): WP Shopify \< 1.5.4 - Reflected XSS (CVSS 6.1, WP Shopify)
- [CVE-2025-6790](https://cve.now/CVE-2025-6790.md): QSM \< 10.2.3 - Template Creation via CSRF (CVSS 4.3, Quiz and Survey Master)
- [CVE-2025-3414](https://cve.now/CVE-2025-3414.md): Structured Content \< 1.7.0 - Contributor Stored XSS (CVSS 5.4, Structured Content (JSON-LD) #wpsc)
- [CVE-2025-8940](https://cve.now/CVE-2025-8940.md): Tenda AC20 saveParentControlInfo strcpy buffer overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-8939](https://cve.now/CVE-2025-8939.md): Tenda AC20 WifiGuestSet buffer overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-8938](https://cve.now/CVE-2025-8938.md): TOTOLINK N350R Telnet Service formSysTel backdoor (CVSS 5.3, TOTOLINK N350R)
- [CVE-2025-5942](https://cve.now/CVE-2025-5942.md): Heap Overflow in Netskope Endpoint DLP Driver (CVSS 5.7, Netskope Client)
- [CVE-2025-0309](https://cve.now/CVE-2025-0309.md): Netskope Client Local Elevation of Privileges (CVSS 6.0, Netskope Client)
- [CVE-2025-5941](https://cve.now/CVE-2025-5941.md): Out-of-Bounds Read Vulnerability in Netskope Client (CVSS 2.0, Netskope Client)
- [CVE-2024-7402](https://cve.now/CVE-2024-7402.md): Netskope Client Configuration Tampering with Local MITM (CVSS 7.0, Netskope Client)
- [CVE-2025-8937](https://cve.now/CVE-2025-8937.md): TOTOLINK N350R formSysCmd command injection (CVSS 5.3, TOTOLINK N350R)
- [CVE-2025-8936](https://cve.now/CVE-2025-8936.md): 1000 Projects Sales Management System dordupdate.php sql injection (CVSS 6.9, 1000 Projects Sales Management System)
- [CVE-2025-8935](https://cve.now/CVE-2025-8935.md): 1000 Projects Sales Management System custcmp.php sql injection (CVSS 6.9, 1000 Projects Sales Management System)
- [CVE-2025-8934](https://cve.now/CVE-2025-8934.md): 1000 Projects Sales Management System sales.php cross site scripting (CVSS 5.3, 1000 Projects Sales Management System)
- [CVE-2025-8933](https://cve.now/CVE-2025-8933.md): 1000 Projects Sales Management System sales.php cross site scripting (CVSS 5.3, 1000 Projects Sales Management System)
- [CVE-2025-8932](https://cve.now/CVE-2025-8932.md): 1000 Projects Sales Management System sales.php sql injection (CVSS 6.9, 1000 Projects Sales Management System)
- [CVE-2025-8931](https://cve.now/CVE-2025-8931.md): code-projects Medical Store Management System ChangePassword.java sql injection (CVSS 5.3, code-projects Medical Store Management System)
- [CVE-2025-8930](https://cve.now/CVE-2025-8930.md): code-projects Medical Store Management System Update Company UpdateCompany.java sql injection (CVSS 5.3, code-projects Medical Store Management System)
- [CVE-2023-43683](https://cve.now/CVE-2023-43683.md): An issue was discovered in Malwarebytes 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). (CVSS 6.5)
- [CVE-2023-43687](https://cve.now/CVE-2023-43687.md): An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). (CVSS 6.5)
- [CVE-2023-43692](https://cve.now/CVE-2023-43692.md): An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). (CVSS 7.5)
- [CVE-2023-43694](https://cve.now/CVE-2023-43694.md): An issue was discovered in Malwarebytes 4.6.14.326 and before and 5.1.5.116 and before (and Nebula 2020-10-21 and later). (CVSS 5.2)
- [CVE-2024-53945](https://cve.now/CVE-2024-53945.md): The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/at (CVSS 8.8)
- [CVE-2024-53946](https://cve.now/CVE-2024-53946.md): The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. (CVSS 8.8)
- [CVE-2025-27845](https://cve.now/CVE-2025-27845.md): In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret (CVSS 9.8)
- [CVE-2025-27846](https://cve.now/CVE-2025-27846.md): In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges because GRUB and the BIO (CVSS 4.3)
- [CVE-2025-27847](https://cve.now/CVE-2025-27847.md): In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout. (CVSS 4.3)
- [CVE-2025-43983](https://cve.now/CVE-2025-43983.md): KuWFi CPF908-CP5 WEB5.0\_LCD\_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform\_set\_cmd\_proce (CVSS 9.1)
- [CVE-2025-43984](https://cve.now/CVE-2025-43984.md): An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321\_V3.2, Software Version: GC111-GL-LM321\_V3.0\_20191211). (CVSS 9.8)
- [CVE-2025-50515](https://cve.now/CVE-2025-50515.md): An issue was discovered in phome Empirebak 2010 in ebak2008/upload/class/config.php allowing attackers to execute arbitrary code when the co (CVSS 6.5)
- [CVE-2025-50518](https://cve.now/CVE-2025-50518.md): A use-after-free vulnerability exists in the coap\_delete\_pdu\_lkd function within coap\_pdu.c of the libcoap library. (CVSS 9.8)
- [CVE-2025-50817](https://cve.now/CVE-2025-50817.md): A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. (CVSS 5.4)
- [CVE-2025-50861](https://cve.now/CVE-2025-50861.md): The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible wit (CVSS 6.5)
- [CVE-2025-50862](https://cve.now/CVE-2025-50862.md): The Lotus Cars Android app (com.lotus.carsdomestic.intl) 1.2.8 has allowBackup=true set in its manifest, allowing data exfiltration via ADB (CVSS 5.9)
- [CVE-2025-51965](https://cve.now/CVE-2025-51965.md): OURPHP thru 8.6.1 is vulnerable to Cross-Site Scripting (XSS) via the "Name" field of the "Complete Profile" functionality under the "My Use (CVSS 6.1)
- [CVE-2025-51986](https://cve.now/CVE-2025-51986.md): An issue was discovered in the demo/LINUXTCP implementation of cwalter-at freemodbus v.2018-09-12 allowing attackers to reach an infinite lo (CVSS 7.5)
- [CVE-2025-52335](https://cve.now/CVE-2025-52335.md): EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.