# CVEs published 2025-08-21

127 CVEs were published on August 21, 2025: 20 critical, 45 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-43753](https://cve.now/CVE-2025-43753.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 202 (CVSS 2.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-43747](https://cve.now/CVE-2025-43747.md): A server-side request forgery (SSRF) vulnerability exists in the Liferay DXP 2025.Q2.0 through 2025.Q2.3 due to insecure domain validation o (CVSS 4.8, Liferay DXP)
- [CVE-2010-20122](https://cve.now/CVE-2010-20122.md): Xftp FTP Client \<= 3.0 PWD Response Buffer Overflow (CVSS 9.3, NetSarang Computer Xftp FTP Client)
- [CVE-2009-20003](https://cve.now/CVE-2009-20003.md): Xenorate \<= 2.50 .xpl File Stack-Based Buffer Overflow (CVSS 8.4, Xenorate)
- [CVE-2010-20115](https://cve.now/CVE-2010-20115.md): Vermillion FTP \<= 1.31 Daemon PORT Command Memory Corruption (CVSS 9.3, Arcane Software Vermillion FTP Daemon)
- [CVE-2010-20114](https://cve.now/CVE-2010-20114.md): VariCAD EN \<= 2010-2.05 .dwb File Stack Buffer Overflow (CVSS 8.4, VariCAD EN)
- [CVE-2010-20123](https://cve.now/CVE-2010-20123.md): Steinberg MyMP3Player \<= 3.0.0.67 Buffer Overflow (CVSS 8.4, Steinberg MyMP3Player)
- [CVE-2010-20007](https://cve.now/CVE-2010-20007.md): Seagull FTP v3.3 Build 409 Stack Buffer Overflow (CVSS 8.5, Rocket Software Seagull FTP Client)
- [CVE-2009-20002](https://cve.now/CVE-2009-20002.md): Millenium MP3 Studio \<= 2.0 .pls File Stack-Based Buffer Overflow (CVSS 8.4, Millenium MP3 Studio)
- [CVE-2010-20120](https://cve.now/CVE-2010-20120.md): Maple \<= v13 Maplet File Creation and Command Execution (CVSS 8.4, Maplesoft Maple)
- [CVE-2010-20034](https://cve.now/CVE-2010-20034.md): Gekko Manager FTP Client \<= 0.77 Stack Buffer Overflow (CVSS 8.5, New Software S.C. Gekko Manager FTP Client)
- [CVE-2009-20004](https://cve.now/CVE-2009-20004.md): gAlan \<= 0.2.1 Buffer Overflow (CVSS 8.4, gAlan)
- [CVE-2010-20108](https://cve.now/CVE-2010-20108.md): FTPPad \<= 1.2.0 Stack Buffer Overflow (CVSS 8.4, FTPPad FTP Client)
- [CVE-2010-20107](https://cve.now/CVE-2010-20107.md): FTP Synchronizer Professional \<= 4.0.73.274 Stack Buffer Overflow (CVSS 8.5, Liuxz Software FTP Synchronizer Professional)
- [CVE-2010-20113](https://cve.now/CVE-2010-20113.md): EasyFTP Server list.html path Stack Buffer Overflow (CVSS 9.3, KMiNT21 Software EasyFTP Server)
- [CVE-2010-20121](https://cve.now/CVE-2010-20121.md): EasyFTP Server \<= 1.7.0.11 CWD Command Stack Buffer Overflow (CVSS 9.3, KMiNT21 Software EasyFTP Server)
- [CVE-2010-20111](https://cve.now/CVE-2010-20111.md): Digital Music Pad \<= 8.2.3.3.4 Stack Buffer Overflow (CVSS 8.4, Digital Music Pad)
- [CVE-2010-20119](https://cve.now/CVE-2010-20119.md): CommuniCrypt Mail \<= 1.16 ANSMTP/AOSMTP ActiveX Control Buffer Overflow (CVSS 8.6, CommuniCrypt Software CommuniCrypt Mail)
- [CVE-2010-20109](https://cve.now/CVE-2010-20109.md): Barracuda Spam & Virus Firewall "locale" Path Traversal (CVSS 8.7, Barracuda Networks Spam & Virus Firewall · Barracuda Net… +1)
- [CVE-2010-10015](https://cve.now/CVE-2010-10015.md): AOL \<= 9.5 Phobos.Playlist 'Import()' Stack-Based Buffer Overflow (CVSS 8.4, AOL)
- [CVE-2010-20112](https://cve.now/CVE-2010-20112.md): Amlibweb NetOpacs webquery.dll Stack Buffer Overflow (CVSS 9.3, Amlibweb Library Management System)
- [CVE-2025-54460](https://cve.now/CVE-2025-54460.md): AVEVA PI Integrator Unrestricted Upload of File with Dangerous Type (CVSS 7.1, AVEVA PI Integrator)
- [CVE-2025-41415](https://cve.now/CVE-2025-41415.md): AVEVA PI Integrator Insertion of Sensitive Information into Sent Data (CVSS 6.5, AVEVA PI Integrator)
- [CVE-2025-55231](https://cve.now/CVE-2025-55231.md): Windows Storage-based Management Service Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows Server 2012 R2 · Microsoft Windows Server)
- [CVE-2025-55229](https://cve.now/CVE-2025-55229.md): Windows Certificate Spoofing Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2025-55230](https://cve.now/CVE-2025-55230.md): Windows MBT Transport Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-53795](https://cve.now/CVE-2025-53795.md): Microsoft PC Manager Elevation of Privilege Vulnerability (CVSS 9.1, Microsoft PC Manager)
- [CVE-2025-53763](https://cve.now/CVE-2025-53763.md): Azure Databricks Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Purview Data Governance)
- [CVE-2025-24489](https://cve.now/CVE-2025-24489.md): INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type (CVSS 6.3, INFINITT Healthcare INFINITT PACS System Manager)
- [CVE-2025-27714](https://cve.now/CVE-2025-27714.md): INFINITT Healthcare INFINITT PACS Unrestricted Upload of File with Dangerous Type (CVSS 6.3, INFINITT Healthcare INFINITT PACS System Manager)
- [CVE-2025-3128](https://cve.now/CVE-2025-3128.md): Mitsubishi Electric Europe smartRTU OS Command Injection (CVSS 9.8, Mitsubishi Electric Europe smartRTU)
- [CVE-2025-27721](https://cve.now/CVE-2025-27721.md): INFINITT Healthcare INFINITT PACS Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVSS 7.5, INFINITT Healthcare INFINITT PACS System Manager)
- [CVE-2025-55107](https://cve.now/CVE-2025-55107.md): BUG-000177335 ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability. (CVSS 4.8, Esri Portal for ArcGIS Enterprise Sites)
- [CVE-2025-55106](https://cve.now/CVE-2025-55106.md): BUG-000173171 ArcGIS Enterprise Sites has a Cross-site Scripting vulnerability. (CVSS 4.8, Esri Portal for ArcGIS Enterprise Sites)
- [CVE-2025-55105](https://cve.now/CVE-2025-55105.md): BUG-000177336 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability. (CVSS 4.8, Esri Portal for ArcGIS Enterprise Experience Sites)
- [CVE-2025-55104](https://cve.now/CVE-2025-55104.md): BUG-000173918 - ArcGIS Enterprise Sites has a security vulnerability. (CVSS 4.8, Esri Portal for ArcGIS Enterprise Sites)
- [CVE-2025-55103](https://cve.now/CVE-2025-55103.md): BUG-000177333 - ArcGIS Enterprise Sites has a stored Cross-site Scripting vulnerability. (CVSS 4.8, Esri Portal for ArcGIS Enterprise Sites)
- [CVE-2025-38743](https://cve.now/CVE-2025-38743.md): Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains a Buffer Access with Incorrect Length Value vulnerability. (CVSS 7.8, Dell iDRAC Service Module)
- [CVE-2025-38742](https://cve.now/CVE-2025-38742.md): Dell iDRAC Service Module (iSM), versions prior to 6.0.3.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. (CVSS 5.3, Dell iDRAC Service Module)
- [CVE-2025-57751](https://cve.now/CVE-2025-57751.md): Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs (CVSS 7.7, pyload · pyload-ng)
- [CVE-2025-7051](https://cve.now/CVE-2025-7051.md): N-central Syslog Configuration Insecure Direct Object Reference (CVSS 8.3, N-able N-central)
- [CVE-2025-57768](https://cve.now/CVE-2025-57768.md): Stored XSS in “hours” fields when creating or editing an issue, using SQLite database (CVSS 6.9, Alanaktion phproject)
- [CVE-2025-43754](https://cve.now/CVE-2025-43754.md): Username enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-57765](https://cve.now/CVE-2025-57765.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'pre\_cadastro\_adotante.php' parameter 'msg\_e' (CVSS 6.5, LabRedesCefetRJ WeGIA)
- [CVE-2025-57764](https://cve.now/CVE-2025-57764.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg\_e' (CVSS 6.5, LabRedesCefetRJ WeGIA)
- [CVE-2025-9311](https://cve.now/CVE-2025-9311.md): itsourcecode Apartment Management System addfair.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-8402](https://cve.now/CVE-2025-8402.md): Nil pointer dereference in bulk import crashes server (CVSS 4.9, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-6465](https://cve.now/CVE-2025-6465.md): Path traversal in image upload with preview overwrite (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-57763](https://cve.now/CVE-2025-57763.md): Cross-Site Scripting (XSS) Reflected in 'insere\_despacho.php' parameter 'sccs' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-57762](https://cve.now/CVE-2025-57762.md): WeGIA Stored Cross-Site Scripting (XSS) vulnerability in the endpoint 'dependente\_docdependente.php' with parameter 'nome' (CVSS 6.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-43755](https://cve.now/CVE-2025-43755.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 20 (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-57761](https://cve.now/CVE-2025-57761.md): WeGIA SQL Injection vulnerability via 'id\_funcionario' param at endpoint \`/html/funcionario/dependente\_remover.php\` (CVSS 9.4, LabRedesCefetRJ WeGIA)
- [CVE-2025-7969](https://cve.now/CVE-2025-7969.md): Markdown-it 14.1.0 - Cross-site scripting (XSS) (CVSS 6.9, markdown-it)
- [CVE-2025-9310](https://cve.now/CVE-2025-9310.md): yeqifu carRental Druid login.html hard-coded credentials (CVSS 6.9, yeqifu carRental)
- [CVE-2025-9309](https://cve.now/CVE-2025-9309.md): Tenda AC10 MD5 Hash shadow hard-coded credentials (CVSS 2.0, Tenda AC10)
- [CVE-2025-57755](https://cve.now/CVE-2025-57755.md): claude-code-router CORS. misconfiguration (CVSS 8.1, musistudio claude-code-router · @musistudio/claude-code-rou…)
- [CVE-2025-43756](https://cve.now/CVE-2025-43756.md): \<!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}--\>A reflected cross-site scripting (XSS) vulnerability in the Liferay (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-57754](https://cve.now/CVE-2025-57754.md): eslint-ban-moment exposed a sensitive Supabase URI in .env (Credential leak) (CVSS 9.8, kristoferfannar eslint-ban-moment)
- [CVE-2025-57753](https://cve.now/CVE-2025-57753.md): vite-plugin-static-copy files not included in \`src\` are accessible with a crafted request (CVSS 6.0, sapphi-red vite-plugin-static-copy · vite-plugin-static-copy)
- [CVE-2025-9308](https://cve.now/CVE-2025-9308.md): yarnpkg Yarn request-manager.js setOptions redos (CVSS 4.8, yarnpkg Yarn)
- [CVE-2025-9307](https://cve.now/CVE-2025-9307.md): PHPGurukul Online Course Registration session.php sql injection (CVSS 6.9, PHPGurukul Online Course Registration)
- [CVE-2025-55744](https://cve.now/CVE-2025-55744.md): UnoPim vulnerable to CSRF on Product edit feature and creation of other types (CVSS 6.9, unopim · unopim/unopim)
- [CVE-2025-55743](https://cve.now/CVE-2025-55743.md): UnoPim vulnerable to remote code execution through Arbitrary File upload (CVSS 7.3, unopim · unopim/unopim)
- [CVE-2025-9162](https://cve.now/CVE-2025-9162.md): Org.keycloak/keycloak-model-storage-service: variable injection into environment variables (CVSS 4.9, keycloak · Red Hat build of Keycloak +1)
- [CVE-2025-55742](https://cve.now/CVE-2025-55742.md): UnoPim Stored XSS via SVG MIME/Sanitizer Bypass (CVSS 8.0, unopim · unopim/unopim)
- [CVE-2025-9306](https://cve.now/CVE-2025-9306.md): SourceCodester Advanced School Management System addNotice cross site scripting (CVSS 5.1, SourceCodester Advanced School Management System)
- [CVE-2025-55297](https://cve.now/CVE-2025-55297.md): ESF-IDF BluFi Example Memory Overflow Vulnerability (CVSS 5.2, espressif esp-idf)
- [CVE-2025-9305](https://cve.now/CVE-2025-9305.md): SourceCodester Online Bank Management System mnotice.php sql injection (CVSS 6.9, SourceCodester Online Bank Management System)
- [CVE-2025-9304](https://cve.now/CVE-2025-9304.md): SourceCodester Online Bank Management System show.php sql injection (CVSS 6.9, SourceCodester Online Bank Management System)
- [CVE-2025-53251](https://cve.now/CVE-2025-53251.md): WordPress Pin WP theme \< 7.2 - Arbitrary File Upload Vulnerability (CVSS 9.9, An-Themes Pin WP)
- [CVE-2025-48956](https://cve.now/CVE-2025-48956.md): vLLM API endpoints vulnerable to Denial of Service Attacks (CVSS 7.5, vllm-project vllm · vllm)
- [CVE-2025-9303](https://cve.now/CVE-2025-9303.md): TOTOLINK A720R cstecgi.cgi setParentalRules buffer overflow (CVSS 8.7, TOTOLINK A720R)
- [CVE-2025-9302](https://cve.now/CVE-2025-9302.md): PHPGurukul User Management System signup.php sql injection (CVSS 6.9, PHPGurukul User Management System)
- [CVE-2025-34158](https://cve.now/CVE-2025-34158.md): Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/a (CVSS 8.5, Plex Media Server)
- [CVE-2025-9301](https://cve.now/CVE-2025-9301.md): cmake cmForEachCommand.cxx ReplayItems assertion (CVSS 4.8, cmake)
- [CVE-2025-9300](https://cve.now/CVE-2025-9300.md): saitoha libsixel img2sixel encoder.c sixel\_debug\_print\_palette stack-based overflow (CVSS 4.8, saitoha libsixel)
- [CVE-2025-9299](https://cve.now/CVE-2025-9299.md): Tenda M3 getMasterPassengerAnalyseData formGetMasterPassengerAnalyseData stack-based overflow (CVSS 8.7, Tenda M3)
- [CVE-2025-9298](https://cve.now/CVE-2025-9298.md): Tenda M3 QuickIndex formQuickIndex stack-based overflow (CVSS 8.7, Tenda M3)
- [CVE-2025-9297](https://cve.now/CVE-2025-9297.md): Tenda i22 wxportalauth formWeixinAuthInfoGet stack-based overflow (CVSS 8.7, Tenda i22)
- [CVE-2025-9296](https://cve.now/CVE-2025-9296.md): Emlog Pro blogger.php unrestricted upload (CVSS 5.1, Emlog Pro)
- [CVE-2025-8064](https://cve.now/CVE-2025-8064.md): Bible SuperSearch \<= 6.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via selector\_height Parameter (CVSS 6.4, aicwebtech Bible SuperSearch)
- [CVE-2025-47870](https://cve.now/CVE-2025-47870.md): Team invite ID leaked to team admin with no member invite privileges (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-49222](https://cve.now/CVE-2025-49222.md): Mattermost Shared Channel Upload Type Validation Bypass (CVSS 6.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-8023](https://cve.now/CVE-2025-8023.md): Path Traversal in Template Upload Allows Uploading Files Outside Target Directory (CVSS 6.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-53971](https://cve.now/CVE-2025-53971.md): Channel and Team Membership APIs inadvertently allow loss of Member privileges. (CVSS 3.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-47700](https://cve.now/CVE-2025-47700.md): AI plugin APIs can be triggered using post actions (CVSS 3.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-8895](https://cve.now/CVE-2025-8895.md): WP Webhooks \<= 3.3.5 - Unauthenticated Arbitrary File Copy (CVSS 9.8, cozmoslabs WP Webhooks – Automate repetitive tasks by creat…)
- [CVE-2025-49810](https://cve.now/CVE-2025-49810.md): Thread summarization allows persistent access to channel (CVSS 3.5, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-36530](https://cve.now/CVE-2025-36530.md): Import Path Traversal Enables Unauthorized Unsigned Plugin Installation (CVSS 6.8, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2025-7390](https://cve.now/CVE-2025-7390.md): Bypass the client certificate trust check of an opc.https server while only secure communication is allowed (CVSS 9.1, Softing OPC UA C++ SDK · Softing edgeConnector +1)
- [CVE-2025-8607](https://cve.now/CVE-2025-8607.md): SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) \<= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, amans2k SlingBlocks – Gutenberg Blocks by FunnelKit)
- [CVE-2025-7221](https://cve.now/CVE-2025-7221.md): GiveWP – Donation Plugin and Fundraising Platform \<= 4.5.0 - Missing Authorization to Donation Update (CVSS 4.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2025-8592](https://cve.now/CVE-2025-8592.md): Inspiro \<= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation (CVSS 8.1, wpzoom Inspiro)
- [CVE-2025-53505](https://cve.now/CVE-2025-53505.md): Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a path traversal vulnerability. (CVSS 4.3, Intermesh BV Group-Office)
- [CVE-2025-53504](https://cve.now/CVE-2025-53504.md): Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. (CVSS 5.4, Intermesh BV Group-Office)
- [CVE-2025-48355](https://cve.now/CVE-2025-48355.md): WordPress ProveSource Social Proof plugin \<= 3.1.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, ProveSource Social Proof)
- [CVE-2025-43300](https://cve.now/CVE-2025-43300.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 10.0, KEV, Apple iOS and iPadOS · Apple iPadOS +1)
- [CVE-2025-24285](https://cve.now/CVE-2025-24285.md): Multiple Improper Input Validation vulnerabilities in UniFi Connect EV Station Lite may allow a Command Injection by a malicious actor with (CVSS 9.8, Ubiquiti UniFi Connect EV Station Lite)
- [CVE-2025-27213](https://cve.now/CVE-2025-27213.md): An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug B (CVSS 4.9, Ubiquiti UniFi Connect EV Station Pro · Ubiquiti UniFi Conn…)
- [CVE-2025-48978](https://cve.now/CVE-2025-48978.md): An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.11.0 and earlier) could allow a Command Injection by a malicious actor with ac (CVSS 7.5, Ubiquiti EdgeMAX EdgeSwitch)
- [CVE-2025-27215](https://cve.now/CVE-2025-27215.md): An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsu (CVSS 8.1, Ubiquiti UniFi Connect Display Cast)
- [CVE-2025-27214](https://cve.now/CVE-2025-27214.md): A Missing Authentication for Critical Function vulnerability in the UniFi Connect EV Station Pro may allow a malicious actor with physical o (CVSS 9.8, Ubiquiti UniFi Connect EV Station Pro)
- [CVE-2025-27216](https://cve.now/CVE-2025-27216.md): Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to e (CVSS 8.8, Ubiquiti UISP Application)
- [CVE-2025-27217](https://cve.now/CVE-2025-27217.md): A Server-Side Request Forgery (SSRF) in the UISP Application may allow a malicious actor with certain permissions to make requests outside o (CVSS 9.1, Ubiquiti UISP Application)
- [CVE-2024-45438](https://cve.now/CVE-2024-45438.md): An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. (CVSS 9.1)
- [CVE-2024-50641](https://cve.now/CVE-2024-50641.md): An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. (CVSS 8.1)
- [CVE-2025-47184](https://cve.now/CVE-2025-47184.md): An XML external entities (XXE) injection vulnerability in the /init API endpoint in Exagid EX10 before 6.4.0 P20, 7.0.1 P12, and 7.2.0 P08 a (CVSS 5.3)
- [CVE-2025-50860](https://cve.now/CVE-2025-50860.md): SQL Injection in the listdomains function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to access or manipul (CVSS 5.4)
- [CVE-2025-51606](https://cve.now/CVE-2025-51606.md): hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation. (CVSS 8.8, cn.hippo4j:hippo4j-core)
- [CVE-2025-51818](https://cve.now/CVE-2025-51818.md): MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. (CVSS 5.4)
- [CVE-2025-51989](https://cve.now/CVE-2025-51989.md): HTML injection vulnerability in the registration interface in Evolution Consulting Kft. (CVSS 7.0)
- [CVE-2025-52194](https://cve.now/CVE-2025-52194.md): A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions when processing malformed IRCAM audio fi (CVSS 7.5)
- [CVE-2025-52351](https://cve.now/CVE-2025-52351.md): Aikaan IoT management platform v3.25.0325-5-g2e9c59796 sends a newly generated password to users in plaintext via email and also includes th (CVSS 8.8)
- [CVE-2025-52352](https://cve.now/CVE-2025-52352.md): Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding (CVSS 9.8)
- [CVE-2025-52395](https://cve.now/CVE-2025-52395.md): An issue in Roadcute API v.1 allows a remote attacker to execute arbitrary code via the application exposing a password reset API endpoint t (CVSS 9.8)
- [CVE-2025-55366](https://cve.now/CVE-2025-55366.md): Incorrect access control in the component \\controller\\UserController.java of jshERP v3.5 allows attackers to arbitrarily reset user account (CVSS 5.3)
- [CVE-2025-55367](https://cve.now/CVE-2025-55367.md): Incorrect access control in the component \\controller\\SupplierController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily mo (CVSS 5.3)
- [CVE-2025-55368](https://cve.now/CVE-2025-55368.md): Incorrect access control in the component \\controller\\RoleController.java of jshERP v3.5 allows unauthorized attackers to arbitrarily modify (CVSS 8.8)
- [CVE-2025-55370](https://cve.now/CVE-2025-55370.md): Incorrect access control in the component \\controller\\ResourceController.java of jshERP v3.5 allows unauthorized attackers to obtain all the (CVSS 8.8)
- [CVE-2025-55371](https://cve.now/CVE-2025-55371.md): Incorrect access control in the component /controller/PersonController.java of jshERP v3.5 allows unauthorized attackers to obtain all the i (CVSS 5.3)
- [CVE-2025-55383](https://cve.now/CVE-2025-55383.md): Moss before v0.15 has a file upload vulnerability. (CVSS 8.6)
- [CVE-2025-55420](https://cve.now/CVE-2025-55420.md): A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. (CVSS 8.8)
- [CVE-2025-55521](https://cve.now/CVE-2025-55521.md): An issue in the component /settings/localisation of Akaunting v3.1.18 allows authenticated attackers to cause a Denial of Service (DoS) via (CVSS 6.5)
- [CVE-2025-55522](https://cve.now/CVE-2025-55522.md): Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scr (CVSS 6.5)
- [CVE-2025-55523](https://cve.now/CVE-2025-55523.md): An issue in the component /api/download\_work\_dir\_file.py of Agent-Zero v0.8.\* allows attackers to execute a directory traversal. (CVSS 3.5)
- [CVE-2025-55524](https://cve.now/CVE-2025-55524.md): Insecure permissions in Agent-Zero v0.8.\* allow attackers to arbitrarily reset the system via unspecified vectors. (CVSS 7.3)
- [CVE-2025-55564](https://cve.now/CVE-2025-55564.md): Tenda AC15 v15.03.05.19\_multi\_TD01 has a stack overflow via the list parameter in the fromSetIpMacBind function. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.