CVEs published August 15, 2025
93 CVEs were published on August 15, 2025: 5 critical, 23 high.
- Published
- 93
- Critical
- 5
- High
- 23
- Medium
- 59
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- HCL Software BigFix SaaS Remediate
- 4
- itsourcecode Online Tour and Travel Management System
- 4
- projectworlds Travel Management System
- 4
- Autodesk AutoCAD · Autodesk Civil +1
- 3
- code-projects Online Medicine Guide
- 3
- mtons mblog
- 3
- PHPGurukul Online Shopping Portal Project
- 3
- bplugins bSlider – Create Responsive Image, Post, Product,…
- 2
- FirebirdSQL firebird
- 2
- Mechrevo Control Center GX
- 2
Critical 5
- CVE-2025-8995Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096Drupal Authenticator Login · drupal/alogin
- CVE-2025-9060MFlash Remote Code Execution (RCE) after authentication of a user with the "administrator" roleMSoft MFlash
- CVE-2025-54473Extension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomlaphoca.cz - Phoca Commander for Joomla
- CVE-2025-7778Icons Factory <= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete_files() Functionartkrylov Icons Factory
- CVE-2025-6679Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Uploadbitpressadmin Bit Form – Custom Contact Form, Multi Step, C…
High 23
- CVE-2025-8959HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink AttackHashiCorp Shared library · github.com/hashicorp/go-getter
- CVE-2025-43490HP Hotkey Support – Escalation of PrivilegeHP Hotkey Support Software
- CVE-2025-8361Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093Drupal Config Pages · drupal/config_pages
- CVE-2025-8092COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092Drupal COOKiES Consent Management · drupal/cookies
- CVE-2025-49898WordPress Dropshix plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerabilityXolluteon Dropshix
- CVE-2025-49897WordPress Vertical scroll slideshow gallery v2 plugin <= 9.1 - SQL Injection vulnerabilitygopiplus Vertical scroll slideshow gallery
- CVE-2025-24975Firebird Non-Authorized Access to Encrypted Database Using Execute Statement on ExternalFirebirdSQL firebird
- CVE-2025-5048DGN File Parsing Memory Corruption VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-5047DGN File Parsing Uninitialized Variable VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-5046DGN File Parsing Out-of-Bounds Read VulnerabilityAutodesk AutoCAD · Autodesk Civil +1
- CVE-2025-1929SQLi in RiskTurk's Treasury Management SoftwareRisk Yazılım Teknolojileri Ltd. Şti. Reel Sektör Hazine ve…
- CVE-2025-54475Extension - joomsky.com - SQL injection in JS jobs component version 1.3.2 - 1.4.4 for Joomlajoomsky.com JS Jobs component for Joomla
- CVE-2025-54474Extension - dj-extensions.com - SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomladj-extensions.com DJ-Classifieds component for Joomla
- CVE-2025-9046Tenda AC20 setMacFilterCfg sub_46A2AC stack-based overflowTenda AC20
- CVE-2025-9023Tenda AC7/AC18 SetLEDCfg formSetSchedLed buffer overflowTenda AC7 · Tenda AC18
- CVE-2025-7641Assistant for NextGEN Gallery <= 1.0.9 - Unauthenticated Arbitrary Directory Deletion48hmorris Assistant for NextGEN Gallery
- CVE-2025-7650BizCalendar Web <= 1.1.0.53 - Authenticated (Contributor+) Local File Inclusionsetriosoft BizCalendar Web
- CVE-2025-9016Mechrevo Control Center GX V2 Powershell Script Command uncontrolled search pathMechrevo Control Center GX
- CVE-2025-9007Tenda CH22 editFileName formeditFileName buffer overflowTenda CH22
- CVE-2025-9006Tenda CH22 delFileName formdelFileName buffer overflowTenda CH22
- CVE-2025-6025Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discountsrailmedia Order Tip for WooCommerce
- CVE-2025-8342WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypassglboy OTP Login With Phone Number, OTP Verification
- CVE-2025-9000Mechrevo Control Center GX V2 reg File uncontrolled search pathMechrevo Control Center GX
Medium, low and unrated 65
- CVE-2017-20199Buttercup buttercup-browser-extension Vault access controlbuttercup-browser-extension
- CVE-2025-52618HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerabilityHCL Software BigFix SaaS Remediate
- CVE-2025-52619HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosureHCL Software BigFix SaaS Remediate
- CVE-2025-52620HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerabilityHCL Software BigFix SaaS Remediate
- CVE-2025-52621HCL BigFix SaaS Authentication Service is vulnerable to cache poisoningHCL Software BigFix SaaS Remediate
- CVE-2025-43201This issue was addressed with improved checks.Apple Music Classical
- CVE-2025-36088IBM TS4500 cross-site scriptingIBM Storage TS4500 Library
- CVE-2025-55285@backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`backstage · @backstage/plugin-scaffolder-backend
- CVE-2025-7961KAP 3.6.0 - TCC BypassWulkano KAP
- CVE-2025-8996Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097Drupal Layout Builder Advanced Permissions · drupal/layout_…
- CVE-2025-8675AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095Drupal AI SEO Link Advisor · drupal/ai_seo_link_advisor
- CVE-2025-8362GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094Drupal GoogleTag Manager · drupal/gtm
- CVE-2025-8066Bunker Web 1.6.2 - Uncontrolled external site redirectBunkerity Bunker Web
- CVE-2025-49432WordPress Ultimate Video Player Plugin <= 10.1 - Broken Access Control VulnerabilityFWDesign Ultimate Video Player
- CVE-2025-55207@astrojs/node's trailing slash handling causes open redirect issuewithastro astro · @astrojs/node
- CVE-2025-55203Plane Stored XSS in Add Work Item Functionalitymakeplane plane
- CVE-2025-54989Firebird XDR Message Parsing NULL Pointer Dereference Denial-of-Service VulnerabilityFirebirdSQL firebird
- CVE-2025-54466Apache OFBiz: RCE Vulnerability in scrum pluginApache Software Foundation Apache OFBiz
- CVE-2025-9053projectworlds Travel Management System updatesubcategory.php sql injectionprojectworlds Travel Management System
- CVE-2025-9052projectworlds Travel Management System updatepackage.php sql injectionprojectworlds Travel Management System
- CVE-2023-5342Shim: expired secure boot certificateshim-x64 · Red Hat Enterprise Linux
- CVE-2025-9051projectworlds Travel Management System updatecategory.php sql injectionprojectworlds Travel Management System
- CVE-2025-9050projectworlds Travel Management System addcategory.php sql injectionprojectworlds Travel Management System
- CVE-2025-9047projectworlds Visitor Management System visitor_out.php sql injectionprojectworlds Visitor Management System
- CVE-2025-26709Unauthorized Access Vulnerability in ZTE F50ZTE F50
- CVE-2025-9028code-projects Online Medicine Guide adphar.php sql injectioncode-projects Online Medicine Guide
- CVE-2025-9027code-projects Online Medicine Guide addelivery.php sql injectioncode-projects Online Medicine Guide
- CVE-2025-9026D-Link DIR-860L Simple Service Discovery Protocol cgibin ssdpcgi_main os command injectionD-Link DIR-860L
- CVE-2025-9025code-projects Simple Cafe Ordering System portal.php sql injectioncode-projects Simple Cafe Ordering System
- CVE-2025-9024PHPGurukul Beauty Parlour Management System book-appointment.php sql injectionPHPGurukul Beauty Parlour Management System
- CVE-2025-5844Radius Blocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName Parametertechlabpro1 Radius Blocks – WordPress Gutenberg Blocks
- CVE-2025-7662Gestion de tarifs <= 1.4 - Authenticated (Contributor+) SQL Injectionevigeo Gestion de tarifs
- CVE-2025-8905Inpersttion For Theme <= 1.0 - Authenticated (Contributor+) Arbitrary Function CallInpersttion For Theme
- CVE-2025-7507elink – Embed Content <= 1.1.0 - Authenticated (Contributor+) Insufficient Input Validationelinkcontent elink – Embed Content
- CVE-2025-8720Plugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parametermorehawes Plugin README Parser
- CVE-2025-8080Alobaidi Captcha <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin SettingsAlobaidi Captcha
- CVE-2025-8091EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosureashanjay EventON – Events Calendar
- CVE-2025-7688Add User Meta <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scriptingjason-lau Add User Meta
- CVE-2025-9022SourceCodester Online Bank Management System statements.php sql injectionSourceCodester Online Bank Management System
- CVE-2025-9021SourceCodester Online Bank Management System transfer.php sql injectionSourceCodester Online Bank Management System
- CVE-2025-9020PX4 PX4-Autopilot Mavlink Shell Closing mavlink_receiver.cpp handle_message_serial_control use after freePX4-Autopilot
- CVE-2025-8604WP Table Builder – WordPress Table Plugin <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewptb WP Table Builder – Drag & Drop Table Builder
- CVE-2025-9019tcpreplay tcpprep cidr.c mask_cidr6 heap-based overflowtcpreplay
- CVE-2025-9017PHPGurukul Zoo Management System add-foreigner-ticket.php cross site scriptingPHPGurukul Zoo Management System
- CVE-2025-8451Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items'wpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2025-8013Quttera Web Malware Scanner <= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request ForgeryQuttera ThreatSign – Web Malware Scanner for WordPress
- CVE-2025-9013PHPGurukul Online Shopping Portal Project password-recovery.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2025-9012PHPGurukul Online Shopping Portal Project bill-ship-addresses.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2025-9011PHPGurukul Online Shopping Portal Project signup.php sql injectionPHPGurukul Online Shopping Portal Project
- CVE-2025-9010itsourcecode Online Tour and Travel Management System booking_report.php sql injectionitsourcecode Online Tour and Travel Management System
- CVE-2025-9009itsourcecode Online Tour and Travel Management System email_setup.php sql injectionitsourcecode Online Tour and Travel Management System
- CVE-2025-31961HCL Connections is vulnerable to broken access controlHCL Software Connections
- CVE-2025-9008itsourcecode Online Tour and Travel Management System sms_setting.php sql injectionitsourcecode Online Tour and Travel Management System
- CVE-2025-9005mtons mblog register information exposuremtons mblog
- CVE-2025-9004mtons mblog password excessive authenticationmtons mblog
- CVE-2025-9003D-Link DIR-818LW DHCP Reserved Address bsc_lan.php cross site scriptingD-Link DIR-818LW
- CVE-2025-8676B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposurebplugins bSlider – Create Responsive Image, Post, Product,…
- CVE-2025-8867Graphina - Elementor Charts and Graphs <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingiqonicdesign Graphina – Charts and Graphs For Elementor
- CVE-2025-8680B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgerybplugins bSlider – Create Responsive Image, Post, Product,…
- CVE-2025-9002Surbowl dormitory-management-php login.php sql injectionSurbowl dormitory-management-php
- CVE-2025-9001LemonOS HTTP Client main.cpp HTTPGet stack-based overflowLemonOS
- CVE-2025-8993itsourcecode Online Tour and Travel Management System expense_report.php sql injectionitsourcecode Online Tour and Travel Management System
- CVE-2025-8992mtons mblog cross-site request forgerymtons mblog
- CVE-2025-8991linlinjava litemall Business Logic express logic errorlinlinjava litemall
- CVE-2025-8990code-projects Online Medicine Guide browsemdcn.php sql injectioncode-projects Online Medicine Guide