CVEs published August 25, 2025
123 CVEs were published on August 25, 2025: 34 critical, 37 high.
- Published
- 123
- Critical
- 34
- High
- 37
- Medium
- 51
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- The Biosig Project libbiosig
- 24
- SAIL Image Decoding Library
- 8
- itsourcecode Apartment Management System
- 5
- lostvip-com ruoyi-go
- 5
- Securden Unified PAM
- 4
- Arista Networks EOS
- 2
- dataease
- 2
- HuangDou UTCMS
- 2
- itsourcecode Online Tour and Travel Management System
- 2
- mtons mblog
- 2
Critical 34
- CVE-2025-53120Securden Unified PAM Path Traversal In File UploadSecurden Unified PAM
- CVE-2025-53118Securden Unified PAM Authentication BypassSecurden Unified PAM
- CVE-2025-53518An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa)The Biosig Project libbiosig
- CVE-2025-53853A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-52581An integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa)The Biosig Project libbiosig
- CVE-2025-54494A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54493A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54492A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54491A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54490A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54489A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54488A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54487A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54486A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54485A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54484A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54483A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54482A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54481A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-54480A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-53557A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch The Biosig Project libbiosig
- CVE-2025-53511A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch The Biosig Project libbiosig
- CVE-2025-54462A heap-based buffer overflow vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (The Biosig Project libbiosig
- CVE-2025-48005A heap-based buffer overflow vulnerability exists in the RHS2000 parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranThe Biosig Project libbiosig
- CVE-2025-7426MINOVA TTA Information Disclosure and Credential ExposureMINOVA Information Services TTA
- CVE-2025-9118Dataform Path TraversalGoogle Cloud Dataform
- CVE-2025-29514Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to downloa
- CVE-2025-29515Incorrect access control in the DELT_file.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modi
- CVE-2025-45968An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL.
- CVE-2025-50722Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via the Common.php component
- CVE-2025-50900An issue was discovered in getrebuild/rebuild 4.0.4.
- CVE-2025-55575SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=
- CVE-2025-56212phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the docname parameter.
- CVE-2025-56214phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the username parameter.
High 37
- CVE-2025-57809XGrammar affected by Denial of Service by infinite recursion grammarsmlc-ai xgrammar · xgrammar
- CVE-2025-8627Unauthenticated Protocol Commands on TP-Link KP303TP-Link Systems TP-Link KP303 (US) Smartplug
- CVE-2025-57805The Scratch Channel's Publish Articles POST Request Can Upload Articles Without ValidationThe-Scratch-Channel tsc-web-client
- CVE-2025-6188On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do nArista Networks EOS
- CVE-2025-57802Airlink's Daemon Symlink Vulnerabilityairlinklabs daemon
- CVE-2025-57772Dataease H2 JDBC RCE Bypassdataease
- CVE-2025-57773Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerabilitydataease
- CVE-2025-57760Langflow Vulnerable to Privilege Escalation via CLI Superuser Creationlangflow-ai langflow · langflow +1
- CVE-2025-6737Securden Unified PAM Shared SSH Key and Cloud InfrastructureSecurden Unified PAM
- CVE-2025-53119Securden Unified PAM Unauthenticated Unrestricted File UploadSecurden Unified PAM
- CVE-2025-3478OpenText Enterprise Security Manager Stored XSSOpenText Enterprise Security Manager
- CVE-2025-5302Denial of Service (DOS) in JSONReader in run-llama/llama_indexrun-llama/llama_index · llama-index-core
- CVE-2025-46407A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decoding Library v0.9.8.SAIL Image Decoding Library
- CVE-2025-32468A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding Library v0.9.8.SAIL Image Decoding Library
- CVE-2025-35984A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8.SAIL Image Decoding Library
- CVE-2025-53510A memory corruption vulnerability exists in the PSD Image Decoding functionality of the SAIL Image Decoding Library v0.9.8.SAIL Image Decoding Library
- CVE-2025-53085A memory corruption vulnerability exists in the PSD RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8.SAIL Image Decoding Library
- CVE-2025-50129A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8.SAIL Image Decoding Library
- CVE-2025-52930A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8.SAIL Image Decoding Library
- CVE-2025-52456A memory corruption vulnerability exists in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0.9.8.SAIL Image Decoding Library
- CVE-2025-54370PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browserPHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet
- CVE-2025-26467Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only)Apache Software Foundation Apache Cassandra · org.apache.ca…
- CVE-2025-46411A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master BranchThe Biosig Project libbiosig
- CVE-2025-52461An out-of-bounds read vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fThe Biosig Project libbiosig
- CVE-2025-5191Unquoted Search Path Vulnerability in the Utility for Industrial Computers (Windows)Moxa Utility for DRP-A100 Series · Moxa Utility for DRP-C10…
- CVE-2025-54300Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomlanorrnext.com Quantum Mamanger component for Joomla
- CVE-2025-54301Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomlanorrnext.com Quantum Mamanger component for Joomla
- CVE-2023-47799Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administrat
- CVE-2025-29420PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function.
- CVE-2025-29421PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function.
- CVE-2025-29516D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the backup functio
- CVE-2025-29523D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping6 function
- CVE-2025-43960Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., usingvrana/adminer
- CVE-2025-50383alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by parameter.alextselegidis/easyappointments
- CVE-2025-51281D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en`, `val and id parameters in the qj_asp function.
- CVE-2025-55409FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article.
- CVE-2025-56216phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the pagetitle parameter.
Medium, low and unrated 52
- CVE-2025-9429mtons mblog Post submit cross site scriptingmtons mblog
- CVE-2025-9426itsourcecode Online Tour and Travel Management System package.php sql injectionitsourcecode Online Tour and Travel Management System
- CVE-2025-9425itsourcecode Online Tour and Travel Management System enquiry.php sql injectionitsourcecode Online Tour and Travel Management System
- CVE-2025-9424Ruijie WS7204-A branch_import.php os command injectionRuijie WS7204-A
- CVE-2025-9423Campcodes Online Water Billing System editecex.php sql injectionCampcodes Online Water Billing System
- CVE-2025-9422oitcode samarium Team Image team cross site scriptingoitcode samarium
- CVE-2025-9421itsourcecode Apartment Management System addcomplain.php sql injectionitsourcecode Apartment Management System
- CVE-2025-57814request-filtering-agent SSRF Bypass via HTTPS Requestsazu request-filtering-agent · request-filtering-agent
- CVE-2025-9420itsourcecode Apartment Management System addfloor.php sql injectionitsourcecode Apartment Management System
- CVE-2025-57804h2 allows HTTP Request Smuggling due to illegal characters in headerspython-hyper h2 · h2
- CVE-2025-9419itsourcecode Apartment Management System addunit.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9418itsourcecode Apartment Management System addowner.php sql injectionitsourcecode Apartment Management System
- CVE-2025-3456On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-cArista Networks EOS
- CVE-2025-9417itsourcecode Apartment Management System addemployee.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9416oitcode samarium Pages Image webpage cross site scriptingoitcode samarium
- CVE-2025-9415GreenCMS index.php unrestricted uploadGreenCMS
- CVE-2025-9414kalcaddle kodbox Download from Link serverDownload server-side request forgerykalcaddle kodbox
- CVE-2025-9413lostvip-com ruoyi-go system_router.go SelectListByPage sql injectionlostvip-com ruoyi-go
- CVE-2025-57811Craft Potential Remote Code Execution via Twig SSTIcraftcms cms · craftcms/cms
- CVE-2025-9412lostvip-com ruoyi-go DictDataDao.go SelectListByPage sql injectionlostvip-com ruoyi-go
- CVE-2025-9411lostvip-com ruoyi-go LoginInforService.go SelectPageList sql injectionlostvip-com ruoyi-go
- CVE-2025-9410lostvip-com ruoyi-go GenTableDao.go SelectListByPage sql injectionlostvip-com ruoyi-go
- CVE-2025-9409lostvip-com ruoyi-go CommonController.go DownloadUpload path traversallostvip-com ruoyi-go
- CVE-2025-55301The Scratch Channel Allows Username Modificationthe-scratch-channel.github.io
- CVE-2025-9407mtons mblog profile cross site scriptingmtons mblog
- CVE-2025-48303WordPress Post Type Converter plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerabilityKevin Langley Jr. Post Type Converter
- CVE-2025-8562Custom Query Shortcode <= 0.4.0 - Authenticated (Contributor+) Path Traversal via lens Parameterpeterhebert Custom Query Shortcode
- CVE-2025-8997OpenText Enterprise Security Manager Information ExposureOpenText Enterprise Security Manager
- CVE-2025-5514Denial-of-Service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU moduleMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +73
- CVE-2025-9406xuhuisheng lemon CmsArticleController.java uploadImage unrestricted uploadxuhuisheng lemon
- CVE-2025-9405Open5GS gmm-sm.c gmm_state_exception assertionOpen5GS
- CVE-2025-9404Scada-LTS Folder pointHierarchySLTS cross site scriptingScada-LTS
- CVE-2025-9403jqlang jq JSON jq_test.c run_jq_tests assertionjqlang jq
- CVE-2025-9402HuangDou UTCMS Config update.php server-side request forgeryHuangDou UTCMS
- CVE-2025-9401HuangDou UTCMS Login login.php comparisonHuangDou UTCMS
- CVE-2025-9400YiFang CMS P_file.php mergeMultipartUpload unrestricted uploadYiFang CMS
- CVE-2025-9399YiFang CMS L_tool.php sql injectionYiFang CMS
- CVE-2024-39923An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7.
- CVE-2024-46412Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sen
- CVE-2024-46413Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RB
- CVE-2025-29517D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the traceroute6 fu
- CVE-2025-29519A command injection vulnerability in the EXE parameter of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to exec
- CVE-2025-29520Incorrect access control in the Maintenance module of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows authenticated attacke
- CVE-2025-29521Insecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to
- CVE-2025-29522D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping function.
- CVE-2025-29524Incorrect access control in the component /cgi-bin/system_diagnostic_main.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to acc
- CVE-2025-29525DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the m
- CVE-2025-44178DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings.
- CVE-2025-44179Hitron CGNF-TWN 3.1.1.43-TWN-pre3 contains a command injection vulnerability in the telnet service.
- CVE-2025-52130File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller.
- CVE-2025-55574Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code
- CVE-2025-56215phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in contact.php via the pagetitle parameter.