# CVEs published 2025-08-15

93 CVEs were published on August 15, 2025: 5 critical, 23 high. Days are UTC.

- [CVE-2017-20199](https://cve.now/CVE-2017-20199.md): Buttercup buttercup-browser-extension Vault access control (CVSS 2.3, buttercup-browser-extension)
- [CVE-2025-52618](https://cve.now/CVE-2025-52618.md): HCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability (CVSS 4.3, HCL Software BigFix SaaS Remediate)
- [CVE-2025-52619](https://cve.now/CVE-2025-52619.md): HCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure (CVSS 5.3, HCL Software BigFix SaaS Remediate)
- [CVE-2025-52620](https://cve.now/CVE-2025-52620.md): HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability (CVSS 4.3, HCL Software BigFix SaaS Remediate)
- [CVE-2025-52621](https://cve.now/CVE-2025-52621.md): HCL BigFix SaaS Authentication Service is vulnerable to cache poisoning (CVSS 5.3, HCL Software BigFix SaaS Remediate)
- [CVE-2025-43201](https://cve.now/CVE-2025-43201.md): This issue was addressed with improved checks. (CVSS 6.2, Apple Music Classical)
- [CVE-2025-8959](https://cve.now/CVE-2025-8959.md): HashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack (CVSS 7.5, HashiCorp Shared library · github.com/hashicorp/go-getter)
- [CVE-2025-36088](https://cve.now/CVE-2025-36088.md): IBM TS4500 cross-site scripting (CVSS 5.4, IBM Storage TS4500 Library)
- [CVE-2025-43490](https://cve.now/CVE-2025-43490.md): HP Hotkey Support – Escalation of Privilege (CVSS 8.4, HP Hotkey Support Software)
- [CVE-2025-55285](https://cve.now/CVE-2025-55285.md): @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using \`fetch:template\` (CVSS 2.6, backstage · @backstage/plugin-scaffolder-backend)
- [CVE-2025-7961](https://cve.now/CVE-2025-7961.md): KAP 3.6.0 - TCC Bypass (CVSS 6.9, Wulkano KAP)
- [CVE-2025-8996](https://cve.now/CVE-2025-8996.md): Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097 (CVSS 4.3, Drupal Layout Builder Advanced Permissions · drupal/layout\_…)
- [CVE-2025-8995](https://cve.now/CVE-2025-8995.md): Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096 (CVSS 9.8, Drupal Authenticator Login · drupal/alogin)
- [CVE-2025-8675](https://cve.now/CVE-2025-8675.md): AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095 (CVSS 4.7, Drupal AI SEO Link Advisor · drupal/ai\_seo\_link\_advisor)
- [CVE-2025-8362](https://cve.now/CVE-2025-8362.md): GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094 (CVSS 4.3, Drupal GoogleTag Manager · drupal/gtm)
- [CVE-2025-8361](https://cve.now/CVE-2025-8361.md): Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093 (CVSS 7.6, Drupal Config Pages · drupal/config\_pages)
- [CVE-2025-8092](https://cve.now/CVE-2025-8092.md): COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092 (CVSS 7.6, Drupal COOKiES Consent Management · drupal/cookies)
- [CVE-2025-9060](https://cve.now/CVE-2025-9060.md): MFlash Remote Code Execution (RCE) after authentication of a user with the "administrator" role (CVSS 9.1, MSoft MFlash)
- [CVE-2025-8066](https://cve.now/CVE-2025-8066.md): Bunker Web 1.6.2 - Uncontrolled external site redirect (CVSS 4.8, Bunkerity Bunker Web)
- [CVE-2025-49898](https://cve.now/CVE-2025-49898.md): WordPress Dropshix plugin \<= 4.0.14 - Cross Site Scripting (XSS) vulnerability (CVSS 7.6, Xolluteon Dropshix)
- [CVE-2025-49432](https://cve.now/CVE-2025-49432.md): WordPress Ultimate Video Player Plugin \<= 10.1 - Broken Access Control Vulnerability (CVSS 5.3, FWDesign Ultimate Video Player)
- [CVE-2025-49897](https://cve.now/CVE-2025-49897.md): WordPress Vertical scroll slideshow gallery v2 plugin \<= 9.1 - SQL Injection vulnerability (CVSS 8.8, gopiplus Vertical scroll slideshow gallery)
- [CVE-2025-55207](https://cve.now/CVE-2025-55207.md): @astrojs/node's trailing slash handling causes open redirect issue (CVSS 5.5, withastro astro · @astrojs/node)
- [CVE-2025-24975](https://cve.now/CVE-2025-24975.md): Firebird Non-Authorized Access to Encrypted Database Using Execute Statement on External (CVSS 7.1, FirebirdSQL firebird)
- [CVE-2025-55203](https://cve.now/CVE-2025-55203.md): Plane Stored XSS in Add Work Item Functionality (CVSS 5.4, makeplane plane)
- [CVE-2025-54989](https://cve.now/CVE-2025-54989.md): Firebird XDR Message Parsing NULL Pointer Dereference Denial-of-Service Vulnerability (CVSS 5.3, FirebirdSQL firebird)
- [CVE-2025-5048](https://cve.now/CVE-2025-5048.md): DGN File Parsing Memory Corruption Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-5047](https://cve.now/CVE-2025-5047.md): DGN File Parsing Uninitialized Variable Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-5046](https://cve.now/CVE-2025-5046.md): DGN File Parsing Out-of-Bounds Read Vulnerability (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2025-54466](https://cve.now/CVE-2025-54466.md): Apache OFBiz: RCE Vulnerability in scrum plugin (CVSS 6.3, Apache Software Foundation Apache OFBiz)
- [CVE-2025-9053](https://cve.now/CVE-2025-9053.md): projectworlds Travel Management System updatesubcategory.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-9052](https://cve.now/CVE-2025-9052.md): projectworlds Travel Management System updatepackage.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-1929](https://cve.now/CVE-2025-1929.md): SQLi in RiskTurk's Treasury Management Software (CVSS 7.2, Risk Yazılım Teknolojileri Ltd. Şti. Reel Sektör Hazine ve…)
- [CVE-2023-5342](https://cve.now/CVE-2023-5342.md): Shim: expired secure boot certificate (CVSS 4.1, shim-x64 · Red Hat Enterprise Linux)
- [CVE-2025-9051](https://cve.now/CVE-2025-9051.md): projectworlds Travel Management System updatecategory.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-54475](https://cve.now/CVE-2025-54475.md): Extension - joomsky.com - SQL injection in JS jobs component version 1.3.2 - 1.4.4 for Joomla (CVSS 8.7, joomsky.com JS Jobs component for Joomla)
- [CVE-2025-54474](https://cve.now/CVE-2025-54474.md): Extension - dj-extensions.com - SQLi vulnerability in DJ-Classifieds component 3.9.2-3.10.1 for Joomla (CVSS 8.5, dj-extensions.com DJ-Classifieds component for Joomla)
- [CVE-2025-54473](https://cve.now/CVE-2025-54473.md): Extension - phoca.cz - Authenticated RCE vulnerability in Phoca Commander component 1.0.0-4.0.0 and 5.0.0-5.0.1 for Joomla (CVSS 9.2, phoca.cz - Phoca Commander for Joomla)
- [CVE-2025-9050](https://cve.now/CVE-2025-9050.md): projectworlds Travel Management System addcategory.php sql injection (CVSS 6.9, projectworlds Travel Management System)
- [CVE-2025-9047](https://cve.now/CVE-2025-9047.md): projectworlds Visitor Management System visitor\_out.php sql injection (CVSS 6.9, projectworlds Visitor Management System)
- [CVE-2025-9046](https://cve.now/CVE-2025-9046.md): Tenda AC20 setMacFilterCfg sub\_46A2AC stack-based overflow (CVSS 8.7, Tenda AC20)
- [CVE-2025-26709](https://cve.now/CVE-2025-26709.md): Unauthorized Access Vulnerability in ZTE F50 (CVSS 5.7, ZTE F50)
- [CVE-2025-9028](https://cve.now/CVE-2025-9028.md): code-projects Online Medicine Guide adphar.php sql injection (CVSS 6.9, code-projects Online Medicine Guide)
- [CVE-2025-9027](https://cve.now/CVE-2025-9027.md): code-projects Online Medicine Guide addelivery.php sql injection (CVSS 6.9, code-projects Online Medicine Guide)
- [CVE-2025-9026](https://cve.now/CVE-2025-9026.md): D-Link DIR-860L Simple Service Discovery Protocol cgibin ssdpcgi\_main os command injection (CVSS 6.9, D-Link DIR-860L)
- [CVE-2025-9025](https://cve.now/CVE-2025-9025.md): code-projects Simple Cafe Ordering System portal.php sql injection (CVSS 5.3, code-projects Simple Cafe Ordering System)
- [CVE-2025-9024](https://cve.now/CVE-2025-9024.md): PHPGurukul Beauty Parlour Management System book-appointment.php sql injection (CVSS 6.9, PHPGurukul Beauty Parlour Management System)
- [CVE-2025-9023](https://cve.now/CVE-2025-9023.md): Tenda AC7/AC18 SetLEDCfg formSetSchedLed buffer overflow (CVSS 8.7, Tenda AC7 · Tenda AC18)
- [CVE-2025-5844](https://cve.now/CVE-2025-5844.md): Radius Blocks \<= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName Parameter (CVSS 6.4, techlabpro1 Radius Blocks – WordPress Gutenberg Blocks)
- [CVE-2025-7662](https://cve.now/CVE-2025-7662.md): Gestion de tarifs \<= 1.4 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, evigeo Gestion de tarifs)
- [CVE-2025-8905](https://cve.now/CVE-2025-8905.md): Inpersttion For Theme \<= 1.0 - Authenticated (Contributor+) Arbitrary Function Call (CVSS 6.3, Inpersttion For Theme)
- [CVE-2025-7507](https://cve.now/CVE-2025-7507.md): elink – Embed Content \<= 1.1.0 - Authenticated (Contributor+) Insufficient Input Validation (CVSS 6.4, elinkcontent elink – Embed Content)
- [CVE-2025-8720](https://cve.now/CVE-2025-8720.md): Plugin README Parser \<= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter (CVSS 6.4, morehawes Plugin README Parser)
- [CVE-2025-8080](https://cve.now/CVE-2025-8080.md): Alobaidi Captcha \<= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (CVSS 4.4, Alobaidi Captcha)
- [CVE-2025-8091](https://cve.now/CVE-2025-8091.md): EventON Lite \<= 2.4.7 - Authenticated (Contributor+) Information Disclosure (CVSS 4.3, ashanjay EventON – Events Calendar)
- [CVE-2025-7778](https://cve.now/CVE-2025-7778.md): Icons Factory \<= 1.6.12 - Missing Authorization to Unauthenticated Arbitrary File Deletion via delete\_files() Function (CVSS 9.8, artkrylov Icons Factory)
- [CVE-2025-7688](https://cve.now/CVE-2025-7688.md): Add User Meta \<= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, jason-lau Add User Meta)
- [CVE-2025-7641](https://cve.now/CVE-2025-7641.md): Assistant for NextGEN Gallery \<= 1.0.9 - Unauthenticated Arbitrary Directory Deletion (CVSS 7.5, 48hmorris Assistant for NextGEN Gallery)
- [CVE-2025-7650](https://cve.now/CVE-2025-7650.md): BizCalendar Web \<= 1.1.0.53 - Authenticated (Contributor+) Local File Inclusion (CVSS 7.5, setriosoft BizCalendar Web)
- [CVE-2025-9022](https://cve.now/CVE-2025-9022.md): SourceCodester Online Bank Management System statements.php sql injection (CVSS 6.9, SourceCodester Online Bank Management System)
- [CVE-2025-9021](https://cve.now/CVE-2025-9021.md): SourceCodester Online Bank Management System transfer.php sql injection (CVSS 6.9, SourceCodester Online Bank Management System)
- [CVE-2025-9020](https://cve.now/CVE-2025-9020.md): PX4 PX4-Autopilot Mavlink Shell Closing mavlink\_receiver.cpp handle\_message\_serial\_control use after free (CVSS 2.0, PX4-Autopilot)
- [CVE-2025-8604](https://cve.now/CVE-2025-8604.md): WP Table Builder – WordPress Table Plugin \<= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wptb WP Table Builder – Drag & Drop Table Builder)
- [CVE-2025-9019](https://cve.now/CVE-2025-9019.md): tcpreplay tcpprep cidr.c mask\_cidr6 heap-based overflow (CVSS 2.3, tcpreplay)
- [CVE-2025-9017](https://cve.now/CVE-2025-9017.md): PHPGurukul Zoo Management System add-foreigner-ticket.php cross site scripting (CVSS 5.3, PHPGurukul Zoo Management System)
- [CVE-2025-6679](https://cve.now/CVE-2025-6679.md): Contact Form by Bit Form - Bit Form \<= 2.20.3 - Unauthenticated Arbitrary File Upload (CVSS 9.8, bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…)
- [CVE-2025-8451](https://cve.now/CVE-2025-8451.md): Essential Addons for Elementor – Popular Elementor Templates and Widgets \<= 6.2.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-gallery-items' (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2025-8013](https://cve.now/CVE-2025-8013.md): Quttera Web Malware Scanner \<= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 3.8, Quttera ThreatSign – Web Malware Scanner for WordPress)
- [CVE-2025-9016](https://cve.now/CVE-2025-9016.md): Mechrevo Control Center GX V2 Powershell Script Command uncontrolled search path (CVSS 7.3, Mechrevo Control Center GX)
- [CVE-2025-9013](https://cve.now/CVE-2025-9013.md): PHPGurukul Online Shopping Portal Project password-recovery.php sql injection (CVSS 6.9, PHPGurukul Online Shopping Portal Project)
- [CVE-2025-9012](https://cve.now/CVE-2025-9012.md): PHPGurukul Online Shopping Portal Project bill-ship-addresses.php sql injection (CVSS 6.9, PHPGurukul Online Shopping Portal Project)
- [CVE-2025-9011](https://cve.now/CVE-2025-9011.md): PHPGurukul Online Shopping Portal Project signup.php sql injection (CVSS 6.9, PHPGurukul Online Shopping Portal Project)
- [CVE-2025-9010](https://cve.now/CVE-2025-9010.md): itsourcecode Online Tour and Travel Management System booking\_report.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-9009](https://cve.now/CVE-2025-9009.md): itsourcecode Online Tour and Travel Management System email\_setup.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-31961](https://cve.now/CVE-2025-31961.md): HCL Connections is vulnerable to broken access control (CVSS 3.7, HCL Software Connections)
- [CVE-2025-9008](https://cve.now/CVE-2025-9008.md): itsourcecode Online Tour and Travel Management System sms\_setting.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-9007](https://cve.now/CVE-2025-9007.md): Tenda CH22 editFileName formeditFileName buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-9006](https://cve.now/CVE-2025-9006.md): Tenda CH22 delFileName formdelFileName buffer overflow (CVSS 8.7, Tenda CH22)
- [CVE-2025-9005](https://cve.now/CVE-2025-9005.md): mtons mblog register information exposure (CVSS 6.3, mtons mblog)
- [CVE-2025-9004](https://cve.now/CVE-2025-9004.md): mtons mblog password excessive authentication (CVSS 6.3, mtons mblog)
- [CVE-2025-9003](https://cve.now/CVE-2025-9003.md): D-Link DIR-818LW DHCP Reserved Address bsc\_lan.php cross site scripting (CVSS 5.1, D-Link DIR-818LW)
- [CVE-2025-8676](https://cve.now/CVE-2025-8676.md): B Slider - Gutenberg Slider Block for WP \<= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3, bplugins bSlider – Create Responsive Image, Post, Product,…)
- [CVE-2025-8867](https://cve.now/CVE-2025-8867.md): Graphina - Elementor Charts and Graphs \<= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, iqonicdesign Graphina – Charts and Graphs For Elementor)
- [CVE-2025-8680](https://cve.now/CVE-2025-8680.md): B Slider - Gutenberg Slider Block for WP \<= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery (CVSS 4.3, bplugins bSlider – Create Responsive Image, Post, Product,…)
- [CVE-2025-6025](https://cve.now/CVE-2025-6025.md): Order Tip for WooCommerce \<= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts (CVSS 7.5, railmedia Order Tip for WooCommerce)
- [CVE-2025-8342](https://cve.now/CVE-2025-8342.md): WooCommerce OTP Login With Phone Number, OTP Verification \<= 1.8.47 - Authentication Bypass (CVSS 8.1, glboy OTP Login With Phone Number, OTP Verification)
- [CVE-2025-9002](https://cve.now/CVE-2025-9002.md): Surbowl dormitory-management-php login.php sql injection (CVSS 6.9, Surbowl dormitory-management-php)
- [CVE-2025-9001](https://cve.now/CVE-2025-9001.md): LemonOS HTTP Client main.cpp HTTPGet stack-based overflow (CVSS 6.9, LemonOS)
- [CVE-2025-9000](https://cve.now/CVE-2025-9000.md): Mechrevo Control Center GX V2 reg File uncontrolled search path (CVSS 7.3, Mechrevo Control Center GX)
- [CVE-2025-8993](https://cve.now/CVE-2025-8993.md): itsourcecode Online Tour and Travel Management System expense\_report.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System)
- [CVE-2025-8992](https://cve.now/CVE-2025-8992.md): mtons mblog cross-site request forgery (CVSS 5.3, mtons mblog)
- [CVE-2025-8991](https://cve.now/CVE-2025-8991.md): linlinjava litemall Business Logic express logic error (CVSS 5.3, linlinjava litemall)
- [CVE-2025-8990](https://cve.now/CVE-2025-8990.md): code-projects Online Medicine Guide browsemdcn.php sql injection (CVSS 6.9, code-projects Online Medicine Guide)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.