# CVEs published 2025-08-23

29 CVEs were published on August 23, 2025: 2 critical, 10 high. Days are UTC.

- [CVE-2025-9363](https://cve.now/CVE-2025-9363.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 portTriggerManageRule stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9362](https://cve.now/CVE-2025-9362.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 urlFilterManageRule stack-based overflow (CVSS 5.3, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9361](https://cve.now/CVE-2025-9361.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 ipRangeBlockManageRule stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9360](https://cve.now/CVE-2025-9360.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 accessControlAdd stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9359](https://cve.now/CVE-2025-9359.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 RP\_checkCredentialsByBBS stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9358](https://cve.now/CVE-2025-9358.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 setSysAdm stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-5352](https://cve.now/CVE-2025-5352.md): Environment Variable XSS in Analytics Component in lunary-ai/lunary (CVSS 8.1, lunary-ai/lunary)
- [CVE-2025-5060](https://cve.now/CVE-2025-5060.md): Bravis User \<= 1.0.1 - Authentication Bypass to Account Takeover (CVSS 8.1, Bravis-Themes Bravis User)
- [CVE-2025-5821](https://cve.now/CVE-2025-5821.md): Case Theme User \<= 1.0.3 - Authentication Bypass via Social Login (CVSS 9.8, Case-Themes Case Theme User)
- [CVE-2025-9357](https://cve.now/CVE-2025-9357.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 langSwitchByBBS stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-7813](https://cve.now/CVE-2025-7813.md): Event Manager, Events Calendar, Booking, Registrations and Tickets – Eventin \<= 4.0.37 - Unauthenticated Server-Side Request Forgery (CVSS 7.2, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2025-43764](https://cve.now/CVE-2025-43764.md): Self-ReDoS (Regular expression Denial of Service) exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-43765](https://cve.now/CVE-2025-43765.md): A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024 (CVSS 6.9, Liferay Portal · Liferay DXP +1)
- [CVE-2025-7957](https://cve.now/CVE-2025-7957.md): ShortcodeHub \<= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via author\_link\_target Parameter (CVSS 6.4, surror ShortcodeHub – MultiPurpose Shortcode Builder)
- [CVE-2025-7841](https://cve.now/CVE-2025-7841.md): Sertifier Certificate & Badge Maker for WordPress – Tutor LMS \<= 1.19 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, Sertifier Certificate & Badge Maker for WordPress – Tutor L…)
- [CVE-2025-7821](https://cve.now/CVE-2025-7821.md): WC Plus \<= 1.2.0 - Missing Authorization to Unauthenticated Settings Manipulation (CVSS 5.3, wcplus WC Plus)
- [CVE-2025-7828](https://cve.now/CVE-2025-7828.md): WP Filter & Combine RSS Feeds \<= 0.4 - Missing Authorization to Authenticated (Contributor+) Feed Deletion (CVSS 4.3, evigeo WP Filter & Combine RSS Feeds)
- [CVE-2025-7839](https://cve.now/CVE-2025-7839.md): Restore Permanently delete Post or Page Data \<= 1.0 - Cross-Site Request Forgery (CVSS 4.3, pokornydavid Restore Permanently delete Post or Page Data)
- [CVE-2025-7842](https://cve.now/CVE-2025-7842.md): Silencesoft RSS Reader \<= 0.6 - Cross-Site Request Forgery to RSS Feed Deletion (CVSS 4.3, Silencesoft RSS Reader)
- [CVE-2025-8062](https://cve.now/CVE-2025-8062.md): WS Theme Addons \<= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ws\_weather Shortcode (CVSS 6.4, wen-solutions WS Theme Addons)
- [CVE-2025-9048](https://cve.now/CVE-2025-9048.md): Wptobe-memberships \<= 3.4.2 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.1, Wptobe-memberships)
- [CVE-2025-7827](https://cve.now/CVE-2025-7827.md): Ni WooCommerce Customer Product Report \<= 1.2.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update (CVSS 4.3, anzia Ni WooCommerce Customer Product Report)
- [CVE-2025-9131](https://cve.now/CVE-2025-9131.md): Ogulo – 360° Tour \<= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter (CVSS 6.4, Ogulo – 360° Tour)
- [CVE-2025-7642](https://cve.now/CVE-2025-7642.md): Simpler Checkout 0.7.0 - 1.1.9 - Authentication Bypass (CVSS 9.8, simplercheckout Simpler Checkout)
- [CVE-2025-43766](https://cve.now/CVE-2025-43766.md): The Liferay Portal 7.4.0 through 7.3.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 (CVSS 6.8, Liferay Portal · Liferay DXP +1)
- [CVE-2025-43767](https://cve.now/CVE-2025-43767.md): Open Redirect vulnerability in /c/portal/edit\_info\_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 202 (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-43768](https://cve.now/CVE-2025-43768.md): Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2 (CVSS 5.1, Liferay Portal · Liferay DXP +1)
- [CVE-2025-43769](https://cve.now/CVE-2025-43769.md): Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024 (CVSS 4.6, Liferay Portal · Liferay DXP +1)
- [CVE-2025-43770](https://cve.now/CVE-2025-43770.md): A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q (CVSS 6.9, Liferay Portal · Liferay DXP +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.