# CVEs published 2025-08-24

23 CVEs were published on August 24, 2025: 1 critical, 5 high. Days are UTC.

- [CVE-2025-9398](https://cve.now/CVE-2025-9398.md): YiFang CMS Migrate.php exportInstallTable information disclosure (CVSS 6.9, YiFang CMS)
- [CVE-2025-9397](https://cve.now/CVE-2025-9397.md): givanz Vvveb media.php unrestricted upload (CVSS 5.3, givanz Vvveb)
- [CVE-2025-9396](https://cve.now/CVE-2025-9396.md): ckolivas lrzip strtol\_l.c \_\_GI\_\_\_\_\_strtol\_l\_internal null pointer dereference (CVSS 4.8, ckolivas lrzip)
- [CVE-2025-9395](https://cve.now/CVE-2025-9395.md): wangsongyan wblog backup.go RestorePost server-side request forgery (CVSS 5.3, wangsongyan wblog)
- [CVE-2025-9394](https://cve.now/CVE-2025-9394.md): PoDoFo PDF Dictionary PdfTokenizer.cpp DetermineDataType use after free (CVSS 4.8, PoDoFo)
- [CVE-2025-9393](https://cve.now/CVE-2025-9393.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 addStaProfile stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9392](https://cve.now/CVE-2025-9392.md): Linksys RE6250/RE6300/RE6350/RE6500/RE7000/RE9000 qosClassifier stack-based overflow (CVSS 8.7, Linksys RE6250 · Linksys RE6300 +4)
- [CVE-2025-9391](https://cve.now/CVE-2025-9391.md): Bjskzy Zhiyou ERP com.artery.workflow.ServiceImpl getFieldValue sql injection (CVSS 5.3, Bjskzy Zhiyou ERP)
- [CVE-2025-9390](https://cve.now/CVE-2025-9390.md): vim xxd xxd.c main buffer overflow (CVSS 4.8, vim)
- [CVE-2025-9389](https://cve.now/CVE-2025-9389.md): vim memmove-vec-unaligned-erms.S \_\_memmove\_avx\_unaligned\_erms memory corruption (CVSS 4.8, vim)
- [CVE-2025-9388](https://cve.now/CVE-2025-9388.md): Scada-LTS watch\_list.shtm cross site scripting (CVSS 5.1, Scada-LTS)
- [CVE-2025-9387](https://cve.now/CVE-2025-9387.md): DCN DCME-720 Web Management Backend ip\_block.php os command injection (CVSS 5.3, DCN DCME-720)
- [CVE-2025-9386](https://cve.now/CVE-2025-9386.md): appneta tcpreplay tcprewrite get.c get\_l2len\_protocol use after free (CVSS 4.8, appneta tcpreplay)
- [CVE-2025-9385](https://cve.now/CVE-2025-9385.md): appneta tcpreplay tcprewrite edit\_packet.c fix\_ipv6\_checksums use after free (CVSS 4.8, appneta tcpreplay)
- [CVE-2025-9384](https://cve.now/CVE-2025-9384.md): appneta tcpreplay parse\_args.c tcpedit\_post\_args null pointer dereference (CVSS 4.8, appneta tcpreplay)
- [CVE-2025-9383](https://cve.now/CVE-2025-9383.md): FNKvision Y215 CCTV Camera passwd crypt weak hash (CVSS 2.0, FNKvision Y215 CCTV Camera)
- [CVE-2025-9382](https://cve.now/CVE-2025-9382.md): FNKvision Y215 CCTV Camera Telnet Sevice s1\_rf\_test\_config backdoor (CVSS 5.4, FNKvision Y215 CCTV Camera)
- [CVE-2025-9381](https://cve.now/CVE-2025-9381.md): FNKvision Y215 CCTV Camera wpa\_supplicant.conf information disclosure (CVSS 1.0, FNKvision Y215 CCTV Camera)
- [CVE-2025-9380](https://cve.now/CVE-2025-9380.md): FNKvision Y215 CCTV Camera Firmware passwd hard-coded credentials (CVSS 8.5, FNKvision Y215 CCTV Camera)
- [CVE-2025-9379](https://cve.now/CVE-2025-9379.md): Belkin AX1800 Firmware Update data authenticity (CVSS 8.6, Belkin AX1800)
- [CVE-2025-8208](https://cve.now/CVE-2025-8208.md): Spexo Addons for Elementor \<= 1.0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (CVSS 6.4, templatescoderthemes Spexo Addons for Elementor – Elementor…)
- [CVE-2025-36174](https://cve.now/CVE-2025-36174.md): IBM Integrated Analytics System file upload (CVSS 8.0, IBM Integrated Analytics System)
- [CVE-2025-36157](https://cve.now/CVE-2025-36157.md): IBM Engineering Lifecycle Management incorrect authorization (CVSS 9.8, IBM Engineering Lifecycle Management)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.