# CVEs published 2025-08-20

273 CVEs were published on August 20, 2025: 39 critical, 138 high. Days are UTC.

- [CVE-2025-9264](https://cve.now/CVE-2025-9264.md): Xuxueli xxl-job Jobs JobInfoController.java remove resource injection (CVSS 5.3, Xuxueli xxl-job · com.xuxueli:xxl-job-admin)
- [CVE-2025-9263](https://cve.now/CVE-2025-9263.md): Xuxueli xxl-job JobLogController.java getJobsByGroup resource injection (CVSS 5.3, Xuxueli xxl-job · com.xuxueli:xxl-job-admin)
- [CVE-2025-9262](https://cve.now/CVE-2025-9262.md): wong2 mcp-cli oAuth provider.js redirectToAuthorization os command injection (CVSS 6.3, wong2 mcp-cli · @wong2/mcp-cli)
- [CVE-2025-9253](https://cve.now/CVE-2025-9253.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP\_doSpecifySiteSurvey stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9252](https://cve.now/CVE-2025-9252.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DisablePasswordAlertRedirect stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9251](https://cve.now/CVE-2025-9251.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 sta\_wps\_pin stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9288](https://cve.now/CVE-2025-9288.md): Missing type checks leading to hash rewind and passing on crafted data (CVSS 9.1, sha.js)
- [CVE-2025-57749](https://cve.now/CVE-2025-57749.md): n8n has a symlink traversal vulnerability in "Read/Write File" node allows access to restricted files (CVSS 6.5, n8n-io n8n · n8n)
- [CVE-2025-9287](https://cve.now/CVE-2025-9287.md): Missing type checks leading to hash rewind and passing on crafted data (CVSS 9.1, cipher-base)
- [CVE-2025-9250](https://cve.now/CVE-2025-9250.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setPWDbyBBS stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9249](https://cve.now/CVE-2025-9249.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 DHCPReserveAddGroup stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9248](https://cve.now/CVE-2025-9248.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP\_pingGatewayByBBS stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9247](https://cve.now/CVE-2025-9247.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setVlan stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-54988](https://cve.now/CVE-2025-54988.md): Apache Tika PDF parser module: XXE vulnerability in PDFParser's handling of XFA (CVSS 8.4, Apache Software Foundation Apache Tika PDF parser module… +1)
- [CVE-2025-9246](https://cve.now/CVE-2025-9246.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 check\_port\_conflict stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9245](https://cve.now/CVE-2025-9245.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 WPSSTAPINEnr stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9244](https://cve.now/CVE-2025-9244.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 addStaticRoute os command injection (CVSS 5.3, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9241](https://cve.now/CVE-2025-9241.md): elunez eladmin exportUser csv injection (CVSS 5.3, elunez eladmin)
- [CVE-2025-43757](https://cve.now/CVE-2025-43757.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q (CVSS 4.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-5115](https://cve.now/CVE-2025-5115.md): MadeYouReset HTTP/2 vulnerability (CVSS 7.7, Eclipse Jetty · org.eclipse.jetty.http2:http2-common +1)
- [CVE-2025-43746](https://cve.now/CVE-2025-43746.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q (CVSS 5.1, Liferay Portal · Liferay DXP +2)
- [CVE-2025-9240](https://cve.now/CVE-2025-9240.md): elunez eladmin info information disclosure (CVSS 5.3, elunez eladmin)
- [CVE-2025-9239](https://cve.now/CVE-2025-9239.md): elunez eladmin DES Key EncryptUtils.java EncryptUtils inadequate encryption (CVSS 6.3, elunez eladmin)
- [CVE-2025-9238](https://cve.now/CVE-2025-9238.md): Swatadru Exam-Seating-Arrangement Student Login student.php sql injection (CVSS 6.9, Swatadru Exam-Seating-Arrangement)
- [CVE-2025-55746](https://cve.now/CVE-2025-55746.md): Directus allows unauthenticated file upload and file modification due to lacking input sanitization (CVSS 9.3, directus · @directus/api)
- [CVE-2025-9237](https://cve.now/CVE-2025-9237.md): CodeAstro Ecommerce Website Edit Your Account my\_account.php cross site scripting (CVSS 5.1, CodeAstro Ecommerce Website)
- [CVE-2025-9236](https://cve.now/CVE-2025-9236.md): Portabilis i-Educar Tipos de usuàrio educar\_tipo\_usuario\_lst.php sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-47054](https://cve.now/CVE-2025-47054.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-46849](https://cve.now/CVE-2025-46849.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-46852](https://cve.now/CVE-2025-46852.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-9235](https://cve.now/CVE-2025-9235.md): Scada-LTS compound\_events.shtm cross site scripting (CVSS 5.1, Scada-LTS)
- [CVE-2025-9234](https://cve.now/CVE-2025-9234.md): Scada-LTS maintenance\_events.shtm cross site scripting (CVSS 5.1, Scada-LTS)
- [CVE-2025-46856](https://cve.now/CVE-2025-46856.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-46932](https://cve.now/CVE-2025-46932.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-46936](https://cve.now/CVE-2025-46936.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-8309](https://cve.now/CVE-2025-8309.md): User privilege escalation vulnerability (CVSS 8.1, ManageEngine Asset Explorer · ManageEngine ServiceDesk P… +1)
- [CVE-2025-46962](https://cve.now/CVE-2025-46962.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-6183](https://cve.now/CVE-2025-6183.md): Configd Injection (CVSS 7.0, StrongDM sdm-cli)
- [CVE-2025-6182](https://cve.now/CVE-2025-6182.md): Root Certificate Injection (CVSS 8.5, StrongDM sdm)
- [CVE-2025-46998](https://cve.now/CVE-2025-46998.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-6181](https://cve.now/CVE-2025-6181.md): The StrongDM Windows service incorrectly handled input validation. (CVSS 8.5, StrongDM sdm-cli)
- [CVE-2025-6180](https://cve.now/CVE-2025-6180.md): Authentication Hijack (CVSS 8.5, StrongDM sdm-cli)
- [CVE-2010-20010](https://cve.now/CVE-2010-20010.md): Foxit PDF Reader \< 4.2.0.0928 Title Stack Buffer Overflow (CVSS 8.4, Foxit Software Foxit PDF Reader)
- [CVE-2025-8612](https://cve.now/CVE-2025-8612.md): AOMEI Backupper Workstation Link Following Local Privilege Escalation Vulnerability (CVSS 7.3, AOMEI Backupper Workstation)
- [CVE-2025-20345](https://cve.now/CVE-2025-20345.md): Cisco Duo Authentication Proxy Information Disclosure Vulnerability (CVSS 4.9, Cisco Duo Authentication Proxy)
- [CVE-2025-20269](https://cve.now/CVE-2025-20269.md): Cisco Evolved Programmable Network Manager and Prime Infrastructure Arbitrary File Download Vulnerability (CVSS 6.5, Cisco Evolved Programmable Network Manager · Cisco Prime In…)
- [CVE-2025-20131](https://cve.now/CVE-2025-20131.md): Cisco Identity Services Engine Arbitrary File Upload Vulnerability (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2025-8611](https://cve.now/CVE-2025-8611.md): AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability (CVSS 9.8, AOMEI Cyber Backup)
- [CVE-2025-8610](https://cve.now/CVE-2025-8610.md): AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability (CVSS 9.8, AOMEI Cyber Backup)
- [CVE-2025-8415](https://cve.now/CVE-2025-8415.md): Cryostat: authentication bypass if network policies are disabled (CVSS 5.9, Cryostat · Red Hat Cryostat 4 on RHEL +1)
- [CVE-2010-20042](https://cve.now/CVE-2010-20042.md): Xion Audio Player ≤ 1.0.126 Unicode Stack Buffer Overflow (CVSS 8.4, Xion Audio Player)
- [CVE-2011-10025](https://cve.now/CVE-2011-10025.md): Subtitle Processor 7.7.1 .m3u SEH Unicode Buffer Overflow (CVSS 8.5, Subtitle Processor)
- [CVE-2011-10026](https://cve.now/CVE-2011-10026.md): Spreecommerce \< 0.50.x API RCE (CVSS 9.3, Spreecommerce · spree +1)
- [CVE-2011-10022](https://cve.now/CVE-2011-10022.md): SPlayer 3.7 Content-Type Header Buffer Overflow (CVSS 8.6, SPlayer Project SPlayer)
- [CVE-2011-10029](https://cve.now/CVE-2011-10029.md): Solar FTP Server \<= 2.1.1 Malformed USER Denial of Service (CVSS 8.7, Flexbyte Software Solar FTP Server)
- [CVE-2012-10061](https://cve.now/CVE-2012-10061.md): Sockso Music Host Server \<= 1.5 Path Traversal (CVSS 8.7, Sockso Project Music Host Server)
- [CVE-2011-10028](https://cve.now/CVE-2011-10028.md): RealNetworks Arcade Games StubbyUtil.ProcessMgr ActiveX Arbitrary Code Execution (CVSS 8.7, RealNetworks RealArcade ActiveX)
- [CVE-2010-20103](https://cve.now/CVE-2010-20103.md): ProFTPD 1.3.3c Backdoor Command Execution (CVSS 9.3, ProFTPD Project ProFTPD)
- [CVE-2010-10014](https://cve.now/CVE-2010-10014.md): Odin Secure FTP \<= 4.1 Stack Buffer Overflow via LIST Response (CVSS 8.7, Odin Software Odin Secure FTP)
- [CVE-2011-10023](https://cve.now/CVE-2011-10023.md): MJM QuickPlayer \<= 2010 .s3m Stack-Based Buffer Overflow (CVSS 8.4, MJM Software QuickPlayer)
- [CVE-2011-10024](https://cve.now/CVE-2011-10024.md): MJM Core Player 2011 .s3m File Stack-Based Buffer Overflow (CVSS 8.4, MJM Software Core Player)
- [CVE-2011-10021](https://cve.now/CVE-2011-10021.md): Magix Musik Maker \<= v16 .mmm Stack-Based Buffer Overflow (CVSS 8.4, MAGIX Software Magix Musik Maker)
- [CVE-2010-20049](https://cve.now/CVE-2010-20049.md): LeapFTP \< 3.1.x Stack Buffer Overflow (CVSS 9.3, LeapWare LeapFTP)
- [CVE-2011-10020](https://cve.now/CVE-2011-10020.md): Kaillera 0.86 Server DoS via Malformed UDP Packet (CVSS 8.7, Kaillera Project Server)
- [CVE-2010-20059](https://cve.now/CVE-2010-20059.md): FreeNAS \< 0.7.2 rev 5543 exec\_raw.php Arbitrary Command Execution (CVSS 9.3, iXsystems FreeNAS)
- [CVE-2011-10030](https://cve.now/CVE-2011-10030.md): Foxit PDF Reader \< 4.3.1.0218 JavaScript File Write (CVSS 8.4, Foxit Software Foxit PDF Reader)
- [CVE-2010-20045](https://cve.now/CVE-2010-20045.md): FileWrangler \<= 5.30 Stack Buffer Overflow (CVSS 8.5, CursorArts FileWrangler)
- [CVE-2025-9233](https://cve.now/CVE-2025-9233.md): Scada-LTS view\_edit.shtm cross site scripting (CVSS 5.1, Scada-LTS)
- [CVE-2009-10005](https://cve.now/CVE-2009-10005.md): ContentKeeper Web Appliance \< 125.10 Arbitrary File Access via mimencode (CVSS 8.7, ContentKeeper Technologies Web Appliance)
- [CVE-2025-55751](https://cve.now/CVE-2025-55751.md): OnboardLite Open Redirect Endpoint (CVSS 5.1, HackUCF OnboardLite)
- [CVE-2011-10027](https://cve.now/CVE-2011-10027.md): AOL Desktop 9.6 RTX Stack-Based Buffer Overflow (CVSS 8.4, AOL Desktop)
- [CVE-2025-55732](https://cve.now/CVE-2025-55732.md): Frappe has the possibility of SQL Injection due to improper validations (CVSS 8.7, frappe)
- [CVE-2025-55731](https://cve.now/CVE-2025-55731.md): Frappe has the possibility of Authenticated SQL Injection due to improper validations (CVSS 6.3, frappe)
- [CVE-2025-1142](https://cve.now/CVE-2025-1142.md): IBM Edge Application Manager server-side request forgery (CVSS 5.4, IBM Edge Application Manager)
- [CVE-2025-1139](https://cve.now/CVE-2025-1139.md): IBM Edge Application Manager incorrect permissions (CVSS 6.1, IBM Edge Application Manager)
- [CVE-2025-36114](https://cve.now/CVE-2025-36114.md): IBM QRadar SOAR Plugin App path traversal (CVSS 6.5, IBM QRadar SOAR Plugin App)
- [CVE-2025-43748](https://cve.now/CVE-2025-43748.md): Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024. (CVSS 7.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-8448](https://cve.now/CVE-2025-8448.md): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive c (CVSS 1.0, Schneider Eelctric EcoStruxure Building Operation Enterp… +1)
- [CVE-2025-8449](https://cve.now/CVE-2025-8449.md): CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a spec (CVSS 4.1, Schnieder Electric EcoStruxure Building Operation Enterp… +1)
- [CVE-2025-54927](https://cve.now/CVE-2025-54927.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized ac (CVSS 4.9, Schneider Electric EcoStruxure™ Power Monitoring Expert · S…)
- [CVE-2025-54926](https://cve.now/CVE-2025-54926.md): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code exe (CVSS 7.2, Schneider Electric EcoStruxure™ Power Monitoring Expert · S…)
- [CVE-2025-54925](https://cve.now/CVE-2025-54925.md): CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker con (CVSS 7.5, Schneider Electric EcoStruxure™ Power Monitoring Expert · S…)
- [CVE-2025-54924](https://cve.now/CVE-2025-54924.md): CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sen (CVSS 7.5, Schneider Electric EcoStruxure™ Power Monitoring Expert · S…)
- [CVE-2025-54923](https://cve.now/CVE-2025-54923.md): CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity wh (CVSS 8.7, Schneider Electric EcoStruxure™ Power Monitoring Expert · S…)
- [CVE-2025-9074](https://cve.now/CVE-2025-9074.md): Docker Desktop allows unauthenticated access to Docker Engine API from containers (CVSS 9.3, Docker Desktop)
- [CVE-2025-31355](https://cve.now/CVE-2025-31355.md): A firmware update vulnerability exists in the Firmware Signature Validation functionality of Tenda AC6 V5.0 V02.03.01.110. (CVSS 7.2, Tenda AC6)
- [CVE-2025-24322](https://cve.now/CVE-2025-24322.md): An unsafe default authentication vulnerability exists in the Initial Setup Authentication functionality of Tenda AC6 V5.0 V02.03.01.110. (CVSS 8.1, Tenda AC6)
- [CVE-2025-24496](https://cve.now/CVE-2025-24496.md): An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110. (CVSS 7.5, Tenda AC6)
- [CVE-2025-27129](https://cve.now/CVE-2025-27129.md): An authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. (CVSS 9.8, Tenda AC6)
- [CVE-2025-30256](https://cve.now/CVE-2025-30256.md): A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. (CVSS 8.6, Tenda AC6)
- [CVE-2025-32010](https://cve.now/CVE-2025-32010.md): A stack-based buffer overflow vulnerability exists in the Cloud API functionality of Tenda AC6 V5.0 V02.03.01.110. (CVSS 8.1, Tenda AC6)
- [CVE-2025-54175](https://cve.now/CVE-2025-54175.md): Reflected Cross-Site Scripting in QuickCMS.EXT (CVSS 4.6, OpenSolution Quick.CMS.EXT)
- [CVE-2025-54174](https://cve.now/CVE-2025-54174.md): Cross-Site Request Forgery in QuickCMS (CVSS 5.1, OpenSolution Quick.CMS)
- [CVE-2025-8453](https://cve.now/CVE-2025-8453.md): CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privil (CVSS 8.4, Schneider Electric Saitel DR RTU · Schneider Electric Saite…)
- [CVE-2025-54172](https://cve.now/CVE-2025-54172.md): Stored Cross-Site Scripting in QuickCMS (CVSS 4.8, OpenSolution Quick.CMS)
- [CVE-2025-43749](https://cve.now/CVE-2025-43749.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.3, Liferay Portal · Liferay DXP +1)
- [CVE-2025-4877](https://cve.now/CVE-2025-4877.md): Libssh: write beyond bounds in binary to base64 conversion functions (CVSS 4.5, libssh · Red Hat Enterprise Linux +1)
- [CVE-2025-4437](https://cve.now/CVE-2025-4437.md): Cri-o: large /etc/passwd file may lead to denial of service (CVSS 5.7, Red Hat OpenShift Container Platform · github.com/cri-o/cri…)
- [CVE-2025-43750](https://cve.now/CVE-2025-43750.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.1, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3. (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-43741](https://cve.now/CVE-2025-43741.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-7777](https://cve.now/CVE-2025-7777.md): Mirror-registry: host header injection in mirror-registry (CVSS 6.5, mirror registry for Red Hat OpenShift)
- [CVE-2025-43742](https://cve.now/CVE-2025-43742.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-8102](https://cve.now/CVE-2025-8102.md): Easy Digital Downloads \<= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd\_sendwp\_disconnect and edd\_sendwp\_remote\_install Functions (CVSS 5.4, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2025-57734](https://cve.now/CVE-2025-57734.md): In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files (CVSS 4.3, JetBrains TeamCity)
- [CVE-2025-57733](https://cve.now/CVE-2025-57733.md): In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content (CVSS 5.5, JetBrains TeamCity)
- [CVE-2025-57732](https://cve.now/CVE-2025-57732.md): In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership (CVSS 7.5, JetBrains TeamCity)
- [CVE-2025-57731](https://cve.now/CVE-2025-57731.md): In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content (CVSS 8.7, JetBrains YouTrack)
- [CVE-2025-57730](https://cve.now/CVE-2025-57730.md): In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature (CVSS 5.2, JetBrains IntelliJ IDEA)
- [CVE-2025-57729](https://cve.now/CVE-2025-57729.md): In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start (CVSS 6.5, JetBrains IntelliJ IDEA)
- [CVE-2025-57728](https://cve.now/CVE-2025-57728.md): In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files (CVSS 6.5, JetBrains IntelliJ IDEA)
- [CVE-2025-57727](https://cve.now/CVE-2025-57727.md): In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference (CVSS 4.7, JetBrains IntelliJ IDEA)
- [CVE-2024-39954](https://cve.now/CVE-2024-39954.md): Apache EventMesh Runtime: SSRF (CVSS 6.3, Apache Software Foundation Apache EventMesh Runtime · org.a…)
- [CVE-2025-9229](https://cve.now/CVE-2025-9229.md): Information Disclosure in MiR robots and MiR fleet through verbose error pages (CVSS 5.3, Mobile Industrial Robots MiR Robots · Mobile Industrial Rob…)
- [CVE-2025-5261](https://cve.now/CVE-2025-5261.md): IDOR in PozitifIK's Pik Online (CVSS 7.5, Pik Online Yazılım Çözümleri A.Ş. Pik Online)
- [CVE-2025-9228](https://cve.now/CVE-2025-9228.md): Insufficient authorization when creating notes (CVSS 4.3, Mobile Industrial Robots MiR Robots · Mobile Industrial Rob…)
- [CVE-2025-5260](https://cve.now/CVE-2025-5260.md): SSRF in PozitifIK's Pik Online (CVSS 8.6, Pik Online Yazılım Çözümleri A.Ş. Pik Online)
- [CVE-2025-49381](https://cve.now/CVE-2025-49381.md): WordPress ads.txt Guru Connect Plugin \<= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 9.6, ads.txt Guru Connect)
- [CVE-2025-49382](https://cve.now/CVE-2025-49382.md): WordPress JobZilla - Job Board WordPress Theme Theme \<= 2.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, DexignZone JobZilla - Job Board WordPress Theme)
- [CVE-2025-49389](https://cve.now/CVE-2025-49389.md): WordPress Notice Bar Plugin \<= 3.1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WEN Solutions Notice Bar)
- [CVE-2025-49391](https://cve.now/CVE-2025-49391.md): WordPress Sign-up Sheets Plugin \<= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Fetch Designs Sign-up Sheets)
- [CVE-2025-49392](https://cve.now/CVE-2025-49392.md): WordPress Themify Audio Dock Plugin \<= 2.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, themifyme Themify Audio Dock)
- [CVE-2025-49395](https://cve.now/CVE-2025-49395.md): WordPress Themify Icons Plugin \<= 2.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, themifyme Themify Icons)
- [CVE-2025-49396](https://cve.now/CVE-2025-49396.md): WordPress Themify Builder Plugin \<= 7.6.7 - Broken Access Control Vulnerability (CVSS 4.3, themifyme Themify Builder)
- [CVE-2025-49397](https://cve.now/CVE-2025-49397.md): WordPress Colorbox Lightbox Plugin \<= 1.1.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Noor Alam Colorbox Lightbox)
- [CVE-2025-49399](https://cve.now/CVE-2025-49399.md): WordPress NEX-Forms Plugin \<= 9.1.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 8.8, Basix NEX-Forms)
- [CVE-2025-49400](https://cve.now/CVE-2025-49400.md): WordPress WP Visitor Statistics (Real Time Traffic) Plugin \<= 8.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 9.8, osama.esh WP Visitor Statistics)
- [CVE-2025-49406](https://cve.now/CVE-2025-49406.md): WordPress Houzez Theme \<= 4.1.1 - Broken Access Control Vulnerability (CVSS 8.5, favethemes Houzez)
- [CVE-2025-49408](https://cve.now/CVE-2025-49408.md): WordPress Templately Plugin \<= 3.2.7 - Sensitive Data Exposure Vulnerability (CVSS 10.0, WPDeveloper Templately)
- [CVE-2025-28977](https://cve.now/CVE-2025-28977.md): WordPress WP Pipes Plugin \<= 1.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, ThimPress WP Pipes)
- [CVE-2025-30975](https://cve.now/CVE-2025-30975.md): WordPress Add Custom Codes \<= 4.80 - Arbitrary Code Execution vulnerability (CVSS 7.5, SaifuMak Add Custom Codes)
- [CVE-2025-47650](https://cve.now/CVE-2025-47650.md): WordPress Infility Global \<= 2.15.06 - Arbitrary File Download vulnerability (CVSS 6.5, Infility Global)
- [CVE-2025-49409](https://cve.now/CVE-2025-49409.md): WordPress SensorPress plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 9.8, brewlabs SensorPress)
- [CVE-2025-49410](https://cve.now/CVE-2025-49410.md): WordPress TC Testimonials plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 10.0, Imran Emu TC Testimonials)
- [CVE-2025-49411](https://cve.now/CVE-2025-49411.md): WordPress iFrame Block plugin \<= 0.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Vikas Sharma iFrame Block)
- [CVE-2025-49412](https://cve.now/CVE-2025-49412.md): WordPress Page Transition plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, numixtech Page Transition)
- [CVE-2025-49413](https://cve.now/CVE-2025-49413.md): WordPress Super Store Finder Plugin \<= 7.6 - Reflected Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, highwarden Super Store Finder)
- [CVE-2025-49420](https://cve.now/CVE-2025-49420.md): WordPress Ultra Portfolio - WordPress Plugin \<= 6.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, themepassion Ultra Portfolio)
- [CVE-2025-49422](https://cve.now/CVE-2025-49422.md): WordPress Support Ticket Plugin \<= 1.9 - Privilege Escalation Vulnerability (CVSS 9.8, themepassion Support Ticket)
- [CVE-2025-49424](https://cve.now/CVE-2025-49424.md): WordPress Support Ticket Plugin \<= 1.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, themepassion Support Ticket)
- [CVE-2025-49426](https://cve.now/CVE-2025-49426.md): WordPress Kitring Theme \<= 2.8 - Local File Inclusion Vulnerability (CVSS 8.1, Dahz Kitring)
- [CVE-2025-49428](https://cve.now/CVE-2025-49428.md): WordPress Cookie Warning plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.5, Dourou Cookie Warning)
- [CVE-2025-49434](https://cve.now/CVE-2025-49434.md): WordPress Cars4Rent Theme \<= 1.4.2 - PHP Object Injection Vulnerability (CVSS 9.8, axiomthemes Cars4Rent)
- [CVE-2025-49436](https://cve.now/CVE-2025-49436.md): WordPress Anotte theme \<= 1.8 - Local File Inclusion vulnerability (CVSS 8.1, CocoBasic Anotte)
- [CVE-2025-49438](https://cve.now/CVE-2025-49438.md): WordPress Simple Login Log plugin \<= 1.1.3 - PHP Object Injection vulnerability (CVSS 8.1, Max Chirkov Simple Login Log)
- [CVE-2025-49889](https://cve.now/CVE-2025-49889.md): WordPress Edge CPT plugin \<= 1.4 - Local File Inclusion vulnerability (CVSS 8.1, Edge-Themes Edge CPT)
- [CVE-2025-49890](https://cve.now/CVE-2025-49890.md): WordPress Organic Beauty Theme \<= 1.4.6 - PHP Object Injection Vulnerability (CVSS 9.8, ThemeREX Organic Beauty)
- [CVE-2025-49891](https://cve.now/CVE-2025-49891.md): WordPress Uxper Booking Plugin \<= 1.3.3 - SQL Injection Vulnerability (CVSS 8.5, Uxper Booking)
- [CVE-2025-49892](https://cve.now/CVE-2025-49892.md): WordPress Uxper Booking Plugin \<= 1.3.3 - Local File Inclusion Vulnerability (CVSS 8.1, Uxper Booking)
- [CVE-2025-49893](https://cve.now/CVE-2025-49893.md): WordPress Nuss Theme \<= 1.3.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, uxper Nuss)
- [CVE-2025-49894](https://cve.now/CVE-2025-49894.md): WordPress Nuss Theme \<= 1.3.3 - Local File Inclusion Vulnerability (CVSS 8.1, uxper Nuss)
- [CVE-2025-49896](https://cve.now/CVE-2025-49896.md): WordPress WP Discord Post Plus – Supports Unlimited Channels plugin \<= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.3, wptasker WP Discord Post Plus – Supports Unlimited Channels)
- [CVE-2025-48142](https://cve.now/CVE-2025-48142.md): WordPress Bookify \<= 1.0.9 - Privilege Escalation Vulnerability (CVSS 8.8, Saad Iqbal Bookify)
- [CVE-2025-48148](https://cve.now/CVE-2025-48148.md): WordPress StoreKeeper for WooCommerce Plugin \<= 14.4.4 - Arbitrary File Upload Vulnerability (CVSS 10.0, StoreKeeper B.V. StoreKeeper for WooCommerce)
- [CVE-2025-48149](https://cve.now/CVE-2025-48149.md): WordPress Cook&Meal \<= 1.2.3 - Local File Inclusion Vulnerability (CVSS 8.1, dedalx Cook&Meal)
- [CVE-2025-48151](https://cve.now/CVE-2025-48151.md): WordPress CM Map Locations \<= 2.1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, CreativeMindsSolutions CM Map Locations)
- [CVE-2025-48152](https://cve.now/CVE-2025-48152.md): WordPress Rentsyst Plugin \<= 2.0.100 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, dimafreund Rentsyst)
- [CVE-2025-48154](https://cve.now/CVE-2025-48154.md): WordPress Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin \<= 2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Multimedia Playlist Slider Addon for WPBakery…)
- [CVE-2025-48157](https://cve.now/CVE-2025-48157.md): WordPress Formality \<= 1.5.9 - Local File Inclusion Vulnerability (CVSS 8.1, Michele Giorgi Formality)
- [CVE-2025-48158](https://cve.now/CVE-2025-48158.md): WordPress BuddyPress XProfile Custom Image Field Plugin \<= 3.0.1 - Arbitrary File Deletion Vulnerability (CVSS 8.6, Alex Githatu BuddyPress XProfile Custom Image Field)
- [CVE-2025-48159](https://cve.now/CVE-2025-48159.md): WordPress Youtube Vimeo Video Player and Slider WP Plugin \<= 3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Youtube Vimeo Video Player and Slider WP Plugin)
- [CVE-2025-48160](https://cve.now/CVE-2025-48160.md): WordPress Caliris \<= 1.5 - Local File Inclusion Vulnerability (CVSS 8.1, CocoBasic Caliris)
- [CVE-2025-48162](https://cve.now/CVE-2025-48162.md): WordPress Simple Business Directory Pro \<= 15.5.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, quantumcloud Simple Business Directory Pro)
- [CVE-2025-48163](https://cve.now/CVE-2025-48163.md): WordPress SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support \<= 3.5.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup SHOUT - HTML5 Radio Player With Ads - ShoutCas…)
- [CVE-2025-48164](https://cve.now/CVE-2025-48164.md): WordPress SureDash \<= 1.0.3 - Privilege Escalation Vulnerability (CVSS 8.8, Brainstorm Force SureDash)
- [CVE-2025-48165](https://cve.now/CVE-2025-48165.md): WordPress DELUCKS SEO Plugin \<= 2.6.0 - Privilege Escalation Vulnerability (CVSS 8.8, DELUCKS SEO)
- [CVE-2025-48168](https://cve.now/CVE-2025-48168.md): WordPress Apollo - Sticky Full Width HTML5 Audio Player \<= 3.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Apollo - Sticky Full Width HTML5 Audio Player)
- [CVE-2025-48169](https://cve.now/CVE-2025-48169.md): WordPress Code Engine Plugin \<= 0.3.3 - Remote Code Execution (RCE) Vulnerability (CVSS 9.9, Jordy Meow Code Engine)
- [CVE-2025-48170](https://cve.now/CVE-2025-48170.md): WordPress Universal Video Player - Addon for WPBakery Page Builder \<= 3.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Universal Video Player - Addon for WPBakery Pa…)
- [CVE-2025-48171](https://cve.now/CVE-2025-48171.md): WordPress Cena Store \<= 2.11.26 - Local File Inclusion Vulnerability (CVSS 8.1, thembay Cena Store)
- [CVE-2025-48296](https://cve.now/CVE-2025-48296.md): WordPress UpStore \<= 1.7.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, skygroup UpStore)
- [CVE-2025-48297](https://cve.now/CVE-2025-48297.md): WordPress Simple Link Directory \< 14.8.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, quantumcloud Simple Link Directory)
- [CVE-2025-48298](https://cve.now/CVE-2025-48298.md): WordPress SEOPress for MainWP \<= 1.4 - Local File Inclusion Vulnerability (CVSS 7.5, Benjamin Denis SEOPress for MainWP)
- [CVE-2025-48302](https://cve.now/CVE-2025-48302.md): WordPress FundEngine Plugin \<= 1.7.4 - Local File Inclusion Vulnerability (CVSS 7.5, Roxnor FundEngine)
- [CVE-2025-53194](https://cve.now/CVE-2025-53194.md): WordPress JetEngine \<= 3.7.0 - Remote Code Execution (RCE) Vulnerability (CVSS 8.5, Crocoblock JetEngine)
- [CVE-2025-53195](https://cve.now/CVE-2025-53195.md): WordPress JetEngine plugin \<= 3.7.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Crocoblock JetEngine)
- [CVE-2025-53196](https://cve.now/CVE-2025-53196.md): WordPress JetEngine \<= 3.7.0 - Sensitive Data Exposure Vulnerability (CVSS 6.5, Crocoblock JetEngine)
- [CVE-2025-53198](https://cve.now/CVE-2025-53198.md): WordPress Houzez theme \<= 4.0.4 - Local File Inclusion Vulnerability (CVSS 8.1, favethemes Houzez)
- [CVE-2025-53201](https://cve.now/CVE-2025-53201.md): WordPress Jobmonster theme \<= 4.7.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NooTheme Jobmonster)
- [CVE-2025-53204](https://cve.now/CVE-2025-53204.md): WordPress eventlist plugin \<= 1.9.2 - Local File Inclusion Vulnerability (CVSS 8.1, ovatheme eventlist)
- [CVE-2025-53205](https://cve.now/CVE-2025-53205.md): WordPress Radio Player Shoutcast & Icecast \<= 4.4.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Radio Player Shoutcast & Icecast)
- [CVE-2025-53207](https://cve.now/CVE-2025-53207.md): WordPress WP Travel Gutenberg Blocks plugin \<= 3.9.0 - Local File Inclusion Vulnerability (CVSS 8.1, WP Travel Gutenberg Blocks)
- [CVE-2025-53208](https://cve.now/CVE-2025-53208.md): WordPress Maya Business \<= 1.2.0 - Insecure Direct Object References (IDOR) Vulnerability (CVSS 7.5, paymayapg Maya Business)
- [CVE-2025-53210](https://cve.now/CVE-2025-53210.md): WordPress ZoloBlocks Plugin \<= 2.3.2 - Local File Inclusion Vulnerability (CVSS 7.5, bdthemes ZoloBlocks)
- [CVE-2025-53212](https://cve.now/CVE-2025-53212.md): WordPress Revolution Video Player With Bottom Playlist \<= 2.9.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Revolution Video Player With Bottom Playlist)
- [CVE-2025-53213](https://cve.now/CVE-2025-53213.md): WordPress ReachShip WooCommerce Multi-Carrier & Conditional Shipping \<= 4.3.1 - Arbitrary File Upload Vulnerability (CVSS 9.9, ELEXtensions ReachShip WooCommerce Multi-Carrier & Conditio…)
- [CVE-2025-53226](https://cve.now/CVE-2025-53226.md): WordPress Comments Capcha Box Plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, digitalzoomstudio Comments Capcha Box)
- [CVE-2025-53299](https://cve.now/CVE-2025-53299.md): WordPress ThemeMakers Visual Content Composer Plugin \<= 1.5.8 - PHP Object Injection Vulnerability (CVSS 9.8, ThemeMakers Visual Content Composer)
- [CVE-2025-53319](https://cve.now/CVE-2025-53319.md): WordPress Raptive Ads Plugin \<= 3.8.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Raptive Ads)
- [CVE-2025-53559](https://cve.now/CVE-2025-53559.md): WordPress Universal Video Player - Addon for WPBakery Page Builder \<= 3.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Universal Video Player - Addon for WPBakery Pa…)
- [CVE-2025-53560](https://cve.now/CVE-2025-53560.md): WordPress Noisa theme \<= 2.6.0 - PHP Object Injection Vulnerability (CVSS 8.8, rascals Noisa)
- [CVE-2025-53561](https://cve.now/CVE-2025-53561.md): WordPress Prevent files / folders access Plugin \<= 2.6.0 - Path Traversal Vulnerability (CVSS 6.5, miniOrange Prevent files / folders access)
- [CVE-2025-53562](https://cve.now/CVE-2025-53562.md): WordPress Universal Video Player - Addon for WPBakery Page Builder \<= 3.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Universal Video Player - Addon for WPBakery Pa…)
- [CVE-2025-53563](https://cve.now/CVE-2025-53563.md): WordPress Youtube Vimeo Video Player and Slider \<= 3.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Youtube Vimeo Video Player and Slider)
- [CVE-2025-53564](https://cve.now/CVE-2025-53564.md): WordPress HTML5 Radio Player - WPBakery Page Builder Addon \<= 2.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup HTML5 Radio Player - WPBakery Page Builder Add…)
- [CVE-2025-53565](https://cve.now/CVE-2025-53565.md): WordPress Widget for Google Reviews \<= 1.0.15 - Local File Inclusion Vulnerability (CVSS 8.1, RadiusTheme Widget for Google Reviews)
- [CVE-2025-53567](https://cve.now/CVE-2025-53567.md): WordPress Ghost Kit \<= 3.4.1 - Local File Inclusion Vulnerability (CVSS 8.1, nK Ghost Kit)
- [CVE-2025-53577](https://cve.now/CVE-2025-53577.md): WordPress Global DNS Plugin \<= 3.1.0 - Remote Code Execution (RCE) Vulnerability (CVSS 10.0, thehp Global DNS)
- [CVE-2025-53580](https://cve.now/CVE-2025-53580.md): WordPress Simple Business Directory Pro Plugin \< 15.6.9 - Privilege Escalation Vulnerability (CVSS 9.8, quantumcloud Simple Business Directory Pro)
- [CVE-2025-53983](https://cve.now/CVE-2025-53983.md): WordPress JetElements For Elementor \<= 2.7.7 - Sensitive Data Exposure Vulnerability (CVSS 6.5, Crocoblock JetElements For Elementor)
- [CVE-2025-53985](https://cve.now/CVE-2025-53985.md): WordPress JetTabs \<= 2.2.9 - Sensitive Data Exposure Vulnerability (CVSS 6.5, Crocoblock JetTabs)
- [CVE-2025-53987](https://cve.now/CVE-2025-53987.md): WordPress JetMenu \<= 2.4.11.1 - Sensitive Data Exposure Vulnerability (CVSS 6.5, Crocoblock JetMenu)
- [CVE-2025-53988](https://cve.now/CVE-2025-53988.md): WordPress JetBlocks For Elementor \<= 1.3.18 - Sensitive Data Exposure Vulnerability (CVSS 6.5, Crocoblock JetBlocks For Elementor)
- [CVE-2025-53992](https://cve.now/CVE-2025-53992.md): WordPress JetTricks \<= 1.5.4.1 - Sensitive Data Exposure Vulnerability (CVSS 6.5, Crocoblock JetTricks)
- [CVE-2025-53993](https://cve.now/CVE-2025-53993.md): WordPress JetPopup plugin \<= 2.0.15 - Sensitive Data Exposure vulnerability (CVSS 6.5, Crocoblock JetPopup)
- [CVE-2025-53998](https://cve.now/CVE-2025-53998.md): WordPress JetWooBuilder \<= 2.1.20 - Sensitive Data Exposure Vulnerability (CVSS 6.5, Crocoblock JetWooBuilder)
- [CVE-2025-54007](https://cve.now/CVE-2025-54007.md): WordPress Post Grid and Gutenberg Blocks Plugin \<= 2.3.11 - PHP Object Injection Vulnerability (CVSS 8.8, PickPlugins Post Grid and Gutenberg Blocks)
- [CVE-2025-54008](https://cve.now/CVE-2025-54008.md): WordPress JetSmartFilters \<= 3.6.7 - Sensitive Data Exposure Vulnerability (CVSS 6.5, Crocoblock JetSmartFilters)
- [CVE-2025-54012](https://cve.now/CVE-2025-54012.md): WordPress Welcart e-Commerce Plugin \<= 2.11.16 - PHP Object Injection Vulnerability (CVSS 7.2, info@welcart Welcart e-Commerce)
- [CVE-2025-54014](https://cve.now/CVE-2025-54014.md): WordPress MediCenter - Health Medical Clinic \<= 15.1 - PHP Object Injection Vulnerability (CVSS 9.8, QuanticaLabs MediCenter - Health Medical Clinic)
- [CVE-2025-54017](https://cve.now/CVE-2025-54017.md): WordPress Paid Member Subscriptions \<= 2.15.4 - Local File Inclusion Vulnerability (CVSS 7.5, Cozmoslabs Paid Member Subscriptions)
- [CVE-2025-54019](https://cve.now/CVE-2025-54019.md): WordPress Alone \< 7.8.5 - Arbitrary Code Execution Vulnerability (CVSS 6.5, Beplusthemes Alone)
- [CVE-2025-54021](https://cve.now/CVE-2025-54021.md): WordPress Simple File List plugin \<= 6.1.14 - Arbitrary File Download vulnerability (CVSS 7.5, Mitchell Bennis Simple File List)
- [CVE-2025-54025](https://cve.now/CVE-2025-54025.md): WordPress Coupon Affiliates Plugin \<= 6.4.0 - Settings Change Vulnerability (CVSS 6.5, Elliot Sowersby / RelyWP Coupon Affiliates)
- [CVE-2025-54027](https://cve.now/CVE-2025-54027.md): WordPress Support Board \<= 3.8.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, Schiocco Support Board)
- [CVE-2025-54028](https://cve.now/CVE-2025-54028.md): WordPress CF7 WOW Styler Plugin \<= 1.7.2 - Local File Inclusion Vulnerability (CVSS 7.5, Saleswonder Team: Tobias CF7 WOW Styler)
- [CVE-2025-54031](https://cve.now/CVE-2025-54031.md): WordPress Support Board \<= 3.8.0 - Local File Inclusion Vulnerability (CVSS 8.1, Schiocco Support Board)
- [CVE-2025-54032](https://cve.now/CVE-2025-54032.md): WordPress Real Estate Manager Pro Plugin \<= 12.7.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, WebCodingPlace Real Estate Manager Pro)
- [CVE-2025-54034](https://cve.now/CVE-2025-54034.md): WordPress Newsletters plugin \<= 4.10 - Local File Inclusion vulnerability (CVSS 7.5, Tribulant Software Newsletters)
- [CVE-2025-54040](https://cve.now/CVE-2025-54040.md): WordPress Webba Booking \<= 5.1.20 - Broken Access Control Vulnerability (CVSS 6.5, Webba Appointment Booking Webba Booking)
- [CVE-2025-54044](https://cve.now/CVE-2025-54044.md): WordPress Elite Video Player \<= 10.0.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, \_CreativeMedia\_ Elite Video Player)
- [CVE-2025-54046](https://cve.now/CVE-2025-54046.md): WordPress Cost Calculator Plugin \<= 7.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, QuanticaLabs Cost Calculator)
- [CVE-2025-54048](https://cve.now/CVE-2025-54048.md): WordPress Custom API for WP \<= 4.2.2 - SQL Injection Vulnerability (CVSS 9.3, miniOrange Custom API for WP)
- [CVE-2025-54049](https://cve.now/CVE-2025-54049.md): WordPress Custom API for WP \<= 4.2.2 - Privilege Escalation Vulnerability (CVSS 9.9, miniOrange Custom API for WP)
- [CVE-2025-54052](https://cve.now/CVE-2025-54052.md): WordPress Realtyna Organic IDX plugin \<= 5.0.0 - Local File Inclusion Vulnerability (CVSS 7.5, Realtyna Organic IDX plugin)
- [CVE-2025-54053](https://cve.now/CVE-2025-54053.md): WordPress Groundhogg plugin \<= 4.2.2 - PHP Object Injection vulnerability (CVSS 6.6, Adrian Tobey Groundhogg)
- [CVE-2025-54055](https://cve.now/CVE-2025-54055.md): WordPress Druco \<= 1.5.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, skygroup Druco)
- [CVE-2025-54056](https://cve.now/CVE-2025-54056.md): WordPress Responsive HTML5 Audio Player PRO With Playlist \<= 3.5.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, LambertGroup Responsive HTML5 Audio Player PRO With Playlist)
- [CVE-2025-54670](https://cve.now/CVE-2025-54670.md): WordPress oik Plugin \<= 4.15.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.1, bobbingwide oik)
- [CVE-2025-54677](https://cve.now/CVE-2025-54677.md): WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin \<= 4.5.3 - Arbitrary File Upload Vulnerability (CVSS 9.1, Online Booking & Scheduling Calendar for WordPress by vcita)
- [CVE-2025-54713](https://cve.now/CVE-2025-54713.md): WordPress Taxi Booking Manager for WooCommerce plugin \<= 1.3.0 - Broken Authentication vulnerability (CVSS 9.8, magepeopleteam Taxi Booking Manager for WooCommerce)
- [CVE-2025-54726](https://cve.now/CVE-2025-54726.md): WordPress JS Archive List Plugin \< 6.1.6 - SQL Injection Vulnerability (CVSS 9.3, Miguel Useche JS Archive List)
- [CVE-2025-54735](https://cve.now/CVE-2025-54735.md): WordPress CubeWP Framework Plugin \<= 1.1.24 - Privilege Escalation Vulnerability (CVSS 8.8, Imran Tauqeer CubeWP)
- [CVE-2025-54750](https://cve.now/CVE-2025-54750.md): WordPress Funnel Builder by FunnelKit Plugin \<= 3.11.1 - Local File Inclusion Vulnerability (CVSS 7.5, Aman Funnel Builder by FunnelKit)
- [CVE-2025-55715](https://cve.now/CVE-2025-55715.md): WordPress Otter - Gutenberg Block Plugin \<= 3.1.0 - Sensitive Data Exposure Vulnerability (CVSS 7.5, Themeisle Otter - Gutenberg Block)
- [CVE-2025-9225](https://cve.now/CVE-2025-9225.md): Cross-site scripting (XSS) in MiR robots and MiR fleet (CVSS 5.5, Mobile Industrial Robots MiR Robots · Mobile Industrial Rob…)
- [CVE-2025-9202](https://cve.now/CVE-2025-9202.md): ColorMag \<= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation (CVSS 4.3, themegrill ColorMag)
- [CVE-2025-54551](https://cve.now/CVE-2025-54551.md): Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external control of Web parameter. (CVSS 4.3, FUJIFILM Healthcare Americas Synapse Mobility)
- [CVE-2025-8618](https://cve.now/CVE-2025-8618.md): WPC Smart Quick View for WooCommerce \<= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq\_btn Shortcode (CVSS 6.4, wpclever WPC Smart Quick View for WooCommerce)
- [CVE-2025-55706](https://cve.now/CVE-2025-55706.md): URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. (CVSS 4.3, Six Apart Movable Type)
- [CVE-2025-53522](https://cve.now/CVE-2025-53522.md): Movable Type contains an issue with use of less trusted source. (CVSS 5.3, Six Apart Movable Type)
- [CVE-2025-57791](https://cve.now/CVE-2025-57791.md): Argument Injection Vulnerability in CommServe (CVSS 6.9, Commvault CommCell)
- [CVE-2025-57790](https://cve.now/CVE-2025-57790.md): Path Traversal Vulnerability (CVSS 8.7, Commvault CommCell)
- [CVE-2025-57789](https://cve.now/CVE-2025-57789.md): Vulnerability in Initial Administrator Login Process (CVSS 5.3, Commvault CommCell)
- [CVE-2025-8141](https://cve.now/CVE-2025-8141.md): Redirection for Contact Form 7 \<= 3.2.4 - Unauthenticated Arbitrary File Deletion (CVSS 8.8, themeisle Redirection for Contact Form)
- [CVE-2025-8289](https://cve.now/CVE-2025-8289.md): Redirection for Contact Form 7 \<= 3.2.4 - Unauthenticated PHP Object Injection via PHAR Deserialization (CVSS 7.5, themeisle Redirection for Contact Form)
- [CVE-2025-8145](https://cve.now/CVE-2025-8145.md): Redirection for Contact Form 7 \<= 3.2.4 - Unauthenticated PHP Object Injection (CVSS 8.8, themeisle Redirection for Contact Form)
- [CVE-2024-12223](https://cve.now/CVE-2024-12223.md): Stored Cross-site Scripting (XSS) in Nutanix Prism Central (CVSS 9.3, Nutanix Prism Central)
- [CVE-2025-9132](https://cve.now/CVE-2025-9132.md): Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a cr (CVSS 8.8, Google Chrome)
- [CVE-2025-9193](https://cve.now/CVE-2025-9193.md): TOTVS Portal Meu RH Password Reset redirect (CVSS 5.1, TOTVS Portal Meu RH)
- [CVE-2024-50640](https://cve.now/CVE-2024-50640.md): jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function (CVSS 9.8)
- [CVE-2024-53495](https://cve.now/CVE-2024-53495.md): Incorrect access control in the preHandle function of my-site v1.0.2.RELEASE allows attackers to access sensitive components without authent (CVSS 7.5)
- [CVE-2024-57152](https://cve.now/CVE-2024-57152.md): Incorrect access control in the preHandle function of my-site v1.0.2 allows attackers to access sensitive components without authentication (CVSS 7.5)
- [CVE-2024-57154](https://cve.now/CVE-2024-57154.md): Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/ (CVSS 9.8)
- [CVE-2024-57155](https://cve.now/CVE-2024-57155.md): Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token. (CVSS 9.8)
- [CVE-2024-57157](https://cve.now/CVE-2024-57157.md): Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token. (CVSS 9.8)
- [CVE-2024-57491](https://cve.now/CVE-2024-57491.md): Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API w (CVSS 8.8)
- [CVE-2025-28041](https://cve.now/CVE-2025-28041.md): Incorrect access control in the doFilter function of itranswarp up to 2.19 allows attackers to access sensitive components without authentic (CVSS 8.6)
- [CVE-2025-50503](https://cve.now/CVE-2025-50503.md): A vulnerability in the password reset workflow of the Touch Lebanon Mobile App 2.20.2 allows an attacker to bypass the OTP reset password me (CVSS 8.8)
- [CVE-2025-50864](https://cve.now/CVE-2025-50864.md): An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restriction (CVSS 6.5, @elysiajs/cors)
- [CVE-2025-50901](https://cve.now/CVE-2025-50901.md): JeeWMS 771e4f5d0c01ffdeae1671be4cf102b73a3fe644 (2025-05-19) contains incorrect authentication bypass vulnerability, which can lead to arbit (CVSS 9.8)
- [CVE-2025-50902](https://cve.now/CVE-2025-50902.md): Cross Site Request Forgery (CSRF) vulnerability in old-peanut Open-Shop (aka old-peanut/wechat\_applet\_\_open\_source) thru 1.0.0 allows attack (CVSS 8.8)
- [CVE-2025-50904](https://cve.now/CVE-2025-50904.md): There is an authentication bypass vulnerability in WinterChenS my-site thru commit 6c79286 (2025-06-11). (CVSS 9.8)
- [CVE-2025-51990](https://cve.now/CVE-2025-51990.md): XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, spec (CVSS 4.8)
- [CVE-2025-51991](https://cve.now/CVE-2025-51991.md): XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the (CVSS 8.8)
- [CVE-2025-54363](https://cve.now/CVE-2025-54363.md): Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. (CVSS 6.9, Microsoft Knack)
- [CVE-2025-54364](https://cve.now/CVE-2025-54364.md): Microsoft Knack 0.12.0 allows Regular expression Denial of Service (ReDoS) in the knack.introspection module. (CVSS 6.9, Microsoft Knack)
- [CVE-2025-55444](https://cve.now/CVE-2025-55444.md): A SQL injection vulnerability exists in the id2 parameter of the cancel\_booking.php page in Online Artwork and Fine Arts MCA Project 1.0. (CVSS 9.8)
- [CVE-2025-55482](https://cve.now/CVE-2025-55482.md): Tenda AC6 V15.03.06.23\_multi is vulnerable to Buffer Overflow in the formSetCfm function. (CVSS 7.5)
- [CVE-2025-55483](https://cve.now/CVE-2025-55483.md): Tenda AC6 V15.03.06.23\_multi is vulnerable to Buffer Overflow in the function formSetMacFilterCfg via the parameters macFilterType and devic (CVSS 7.5)
- [CVE-2025-55498](https://cve.now/CVE-2025-55498.md): Tenda AC6 V15.03.06.23\_multi was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function. (CVSS 7.5)
- [CVE-2025-55499](https://cve.now/CVE-2025-55499.md): Tenda AC6 V15.03.06.23\_multi was discovered to contain a buffer overflow via the ntpServer parameter in the fromSetSysTime function. (CVSS 6.5)
- [CVE-2025-55503](https://cve.now/CVE-2025-55503.md): Tenda AC6 V15.03.06.23\_multi has a stack overflow vulnerability via the deviceName parameter in the saveParentControlInfo function. (CVSS 7.3)
- [CVE-2025-57788](https://cve.now/CVE-2025-57788.md): Unauthorized API Access Risk (CVSS 6.9, Commvault CommCell)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.