CVEs published August 21, 2025
127 CVEs were published on August 21, 2025: 20 critical, 45 high. 1 is now in CISA KEV.
- Published
- 127
- Critical
- 20
- High
- 45
- Medium
- 56
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 48
Most affected products
- Mattermost · github.com/mattermost/mattermost-server +3
- 9
- LabRedesCefetRJ WeGIA
- 5
- Esri Portal for ArcGIS Enterprise Sites
- 4
- Liferay Portal · Liferay DXP +1
- 4
- INFINITT Healthcare INFINITT PACS System Manager
- 3
- unopim · unopim/unopim
- 3
- AVEVA PI Integrator
- 2
- Dell iDRAC Service Module
- 2
- Intermesh BV Group-Office
- 2
- KMiNT21 Software EasyFTP Server
- 2
Critical 20
- CVE-2010-20122Xftp FTP Client <= 3.0 PWD Response Buffer OverflowNetSarang Computer Xftp FTP Client
- CVE-2010-20115Vermillion FTP <= 1.31 Daemon PORT Command Memory CorruptionArcane Software Vermillion FTP Daemon
- CVE-2010-20113EasyFTP Server list.html path Stack Buffer OverflowKMiNT21 Software EasyFTP Server
- CVE-2010-20121EasyFTP Server <= 1.7.0.11 CWD Command Stack Buffer OverflowKMiNT21 Software EasyFTP Server
- CVE-2010-20112Amlibweb NetOpacs webquery.dll Stack Buffer OverflowAmlibweb Library Management System
- CVE-2025-53795Microsoft PC Manager Elevation of Privilege VulnerabilityMicrosoft PC Manager
- CVE-2025-53763Azure Databricks Elevation of Privilege VulnerabilityMicrosoft Purview Data Governance
- CVE-2025-3128Mitsubishi Electric Europe smartRTU OS Command InjectionMitsubishi Electric Europe smartRTU
- CVE-2025-57761WeGIA SQL Injection vulnerability via 'id_funcionario' param at endpoint `/html/funcionario/dependente_remover.php`LabRedesCefetRJ WeGIA
- CVE-2025-57754eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak)kristoferfannar eslint-ban-moment
- CVE-2025-53251WordPress Pin WP theme < 7.2 - Arbitrary File Upload VulnerabilityAn-Themes Pin WP
- CVE-2025-8895WP Webhooks <= 3.3.5 - Unauthenticated Arbitrary File Copycozmoslabs WP Webhooks – Automate repetitive tasks by creat…
- CVE-2025-7390Bypass the client certificate trust check of an opc.https server while only secure communication is allowedSofting OPC UA C++ SDK · Softing edgeConnector +1
- CVE-2025-43300An out-of-bounds write issue was addressed with improved bounds checking.Apple iOS and iPadOS · Apple iPadOS +1
- CVE-2025-24285Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with Ubiquiti UniFi Connect EV Station Lite
- CVE-2025-27214A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical oUbiquiti UniFi Connect EV Station Pro
- CVE-2025-27217A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside oUbiquiti UISP Application
- CVE-2024-45438An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14.
- CVE-2025-52352Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding
- CVE-2025-52395An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint t
High 45
- CVE-2009-20003Xenorate <= 2.50 .xpl File Stack-Based Buffer OverflowXenorate
- CVE-2010-20114VariCAD EN <= 2010-2.05 .dwb File Stack Buffer OverflowVariCAD EN
- CVE-2010-20123Steinberg MyMP3Player <= 3.0.0.67 Buffer OverflowSteinberg MyMP3Player
- CVE-2010-20007Seagull FTP v3.3 Build 409 Stack Buffer OverflowRocket Software Seagull FTP Client
- CVE-2009-20002Millenium MP3 Studio <= 2.0 .pls File Stack-Based Buffer OverflowMillenium MP3 Studio
- CVE-2010-20120Maple <= v13 Maplet File Creation and Command ExecutionMaplesoft Maple
- CVE-2010-20034Gekko Manager FTP Client <= 0.77 Stack Buffer OverflowNew Software S.C. Gekko Manager FTP Client
- CVE-2009-20004gAlan <= 0.2.1 Buffer OverflowgAlan
- CVE-2010-20108FTPPad <= 1.2.0 Stack Buffer OverflowFTPPad FTP Client
- CVE-2010-20107FTP Synchronizer Professional <= 4.0.73.274 Stack Buffer OverflowLiuxz Software FTP Synchronizer Professional
- CVE-2010-20111Digital Music Pad <= 8.2.3.3.4 Stack Buffer OverflowDigital Music Pad
- CVE-2010-20119CommuniCrypt Mail <= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer OverflowCommuniCrypt Software CommuniCrypt Mail
- CVE-2010-20109Barracuda Spam & Virus Firewall "locale" Path TraversalBarracuda Networks Spam & Virus Firewall · Barracuda Net… +1
- CVE-2010-10015AOL <= 9.5 Phobos.Playlist 'Import()' Stack-Based Buffer OverflowAOL
- CVE-2025-54460AVEVA PI Integrator Unrestricted Upload of File with Dangerous TypeAVEVA PI Integrator
- CVE-2025-55231Windows Storage-based Management Service Remote Code Execution VulnerabilityMicrosoft Windows Server 2012 R2 · Microsoft Windows Server
- CVE-2025-55230Windows MBT Transport Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-27721INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control SphereINFINITT Healthcare INFINITT PACS System Manager
- CVE-2025-38743Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability.Dell iDRAC Service Module
- CVE-2025-57751Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljspyload · pyload-ng
- CVE-2025-7051N-central Syslog Configuration Insecure Direct Object ReferenceN-able N-central
- CVE-2025-57755claude-code-router CORS. misconfigurationmusistudio claude-code-router · @musistudio/claude-code-rou…
- CVE-2025-55743UnoPim vulnerable to remote code execution through Arbitrary File uploadunopim · unopim/unopim
- CVE-2025-55742UnoPim Stored XSS via SVG MIME/Sanitizer Bypassunopim · unopim/unopim
- CVE-2025-48956vLLM API endpoints vulnerable to Denial of Service Attacksvllm-project vllm · vllm
- CVE-2025-9303TOTOLINK A720R cstecgi.cgi setParentalRules buffer overflowTOTOLINK A720R
- CVE-2025-34158Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/aPlex Media Server
- CVE-2025-9299Tenda M3 getMasterPassengerAnalyseData formGetMasterPassengerAnalyseData stack-based overflowTenda M3
- CVE-2025-9298Tenda M3 QuickIndex formQuickIndex stack-based overflowTenda M3
- CVE-2025-9297Tenda i22 wxportalauth formWeixinAuthInfoGet stack-based overflowTenda i22
- CVE-2025-8592Inspiro <= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installationwpzoom Inspiro
- CVE-2025-48978An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with acUbiquiti EdgeMAX EdgeSwitch
- CVE-2025-27215An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsuUbiquiti UniFi Connect Display Cast
- CVE-2025-27216Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to eUbiquiti UISP Application
- CVE-2024-50641An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before.
- CVE-2025-51606hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation.cn.hippo4j:hippo4j-core
- CVE-2025-51989HTML injection vulnerability in the registration interface in Evolution Consulting Kft.
- CVE-2025-52194A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio fi
- CVE-2025-52351Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes th
- CVE-2025-55368Incorrect access control in the component \controller\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify
- CVE-2025-55370Incorrect access control in the component \controller\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the
- CVE-2025-55383Moss before v0.15 has a file upload vulnerability.
- CVE-2025-55420A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6.
- CVE-2025-55524Insecure permissions in Agent-Zero v0.8.* allow attackers to arbitrarily reset the system via unspecified vectors.
- CVE-2025-55564Tenda AC15 v15.03.05.19_multi_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function.
Medium, low and unrated 62
- CVE-2025-43753A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 202Liferay Portal · Liferay DXP +1
- CVE-2025-43747A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation oLiferay DXP
- CVE-2025-41415AVEVA PI Integrator Insertion of Sensitive Information into Sent DataAVEVA PI Integrator
- CVE-2025-55229Windows Certificate Spoofing VulnerabilityMicrosoft Windows
- CVE-2025-24489INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous TypeINFINITT Healthcare INFINITT PACS System Manager
- CVE-2025-27714INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous TypeINFINITT Healthcare INFINITT PACS System Manager
- CVE-2025-55107BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.Esri Portal for ArcGIS Enterprise Sites
- CVE-2025-55106BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability.Esri Portal for ArcGIS Enterprise Sites
- CVE-2025-55105BUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.Esri Portal for ArcGIS Enterprise Experience Sites
- CVE-2025-55104BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability.Esri Portal for ArcGIS Enterprise Sites
- CVE-2025-55103BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability.Esri Portal for ArcGIS Enterprise Sites
- CVE-2025-38742Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability.Dell iDRAC Service Module
- CVE-2025-57768Stored XSS in “hours” fields when creating or editing an issue, using SQLite databaseAlanaktion phproject
- CVE-2025-43754Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 throughLiferay Portal · Liferay DXP +1
- CVE-2025-57765WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'pre_cadastro_adotante.php' parameter 'msg_e'LabRedesCefetRJ WeGIA
- CVE-2025-57764WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg_e'LabRedesCefetRJ WeGIA
- CVE-2025-9311itsourcecode Apartment Management System addfair.php sql injectionitsourcecode Apartment Management System
- CVE-2025-8402Nil pointer dereference in bulk import crashes serverMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-6465Path traversal in image upload with preview overwriteMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-57763Cross-Site Scripting (XSS) Reflected in 'insere_despacho.php' parameter 'sccs'LabRedesCefetRJ WeGIA
- CVE-2025-57762WeGIA Stored Cross-Site Scripting (XSS) vulnerability in the endpoint 'dependente_docdependente.php' with parameter 'nome'LabRedesCefetRJ WeGIA
- CVE-2025-43755A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 20Liferay Portal · Liferay DXP +1
- CVE-2025-7969Markdown-it 14.1.0 - Cross-site scripting (XSS)markdown-it
- CVE-2025-9310yeqifu carRental Druid login.html hard-coded credentialsyeqifu carRental
- CVE-2025-9309Tenda AC10 MD5 Hash shadow hard-coded credentialsTenda AC10
- CVE-2025-43756<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Liferay Portal · Liferay DXP +1
- CVE-2025-57753vite-plugin-static-copy files not included in `src` are accessible with a crafted requestsapphi-red vite-plugin-static-copy · vite-plugin-static-copy
- CVE-2025-9308yarnpkg Yarn request-manager.js setOptions redosyarnpkg Yarn
- CVE-2025-9307PHPGurukul Online Course Registration session.php sql injectionPHPGurukul Online Course Registration
- CVE-2025-55744UnoPim vulnerable to CSRF on Product edit feature and creation of other typesunopim · unopim/unopim
- CVE-2025-9162Org.keycloak/keycloak-model-storage-service: variable injection into environment variableskeycloak · Red Hat build of Keycloak +1
- CVE-2025-9306SourceCodester Advanced School Management System addNotice cross site scriptingSourceCodester Advanced School Management System
- CVE-2025-55297ESF-IDF BluFi Example Memory Overflow Vulnerabilityespressif esp-idf
- CVE-2025-9305SourceCodester Online Bank Management System mnotice.php sql injectionSourceCodester Online Bank Management System
- CVE-2025-9304SourceCodester Online Bank Management System show.php sql injectionSourceCodester Online Bank Management System
- CVE-2025-9302PHPGurukul User Management System signup.php sql injectionPHPGurukul User Management System
- CVE-2025-9301cmake cmForEachCommand.cxx ReplayItems assertioncmake
- CVE-2025-9300saitoha libsixel img2sixel encoder.c sixel_debug_print_palette stack-based overflowsaitoha libsixel
- CVE-2025-9296Emlog Pro blogger.php unrestricted uploadEmlog Pro
- CVE-2025-8064Bible SuperSearch <= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector_height Parameteraicwebtech Bible SuperSearch
- CVE-2025-47870Team invite ID leaked to team admin with no member invite privilegesMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-49222Mattermost Shared Channel Upload Type Validation BypassMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-8023Path Traversal in Template Upload Allows Uploading Files Outside Target DirectoryMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-53971Channel and Team Membership APIs inadvertently allow loss of Member privileges.Mattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-47700AI plugin APIs can be triggered using post actionsMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-49810Thread summarization allows persistent access to channelMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-36530Import Path Traversal Enables Unauthorized Unsigned Plugin InstallationMattermost · github.com/mattermost/mattermost-server +3
- CVE-2025-8607SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingamans2k SlingBlocks – Gutenberg Blocks by FunnelKit
- CVE-2025-7221GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Missing Authorization to Donation Updatestellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2025-53505Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability.Intermesh BV Group-Office
- CVE-2025-53504Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability.Intermesh BV Group-Office
- CVE-2025-48355WordPress ProveSource Social Proof plugin <= 3.1.2 - Sensitive Data Exposure vulnerabilityProveSource Social Proof
- CVE-2025-27213An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug BUbiquiti UniFi Connect EV Station Pro · Ubiquiti UniFi Conn…
- CVE-2025-47184An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 a
- CVE-2025-50860SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to access or manipul
- CVE-2025-51818MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component.
- CVE-2025-55366Incorrect access control in the component \controller\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account
- CVE-2025-55367Incorrect access control in the component \controller\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily mo
- CVE-2025-55371Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the i
- CVE-2025-55521An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via
- CVE-2025-55522Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scr
- CVE-2025-55523An issue in the component /api/download_work_dir_file.py of Agent-Zero v0.8.* allows attackers to execute a directory traversal.