# CVEs published 2025-08-25 123 CVEs were published on August 25, 2025: 34 critical, 37 high. Days are UTC. - [CVE-2025-9429](https://cve.now/CVE-2025-9429.md): mtons mblog Post submit cross site scripting (CVSS 5.1, mtons mblog) - [CVE-2025-9426](https://cve.now/CVE-2025-9426.md): itsourcecode Online Tour and Travel Management System package.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System) - [CVE-2025-9425](https://cve.now/CVE-2025-9425.md): itsourcecode Online Tour and Travel Management System enquiry.php sql injection (CVSS 6.9, itsourcecode Online Tour and Travel Management System) - [CVE-2025-9424](https://cve.now/CVE-2025-9424.md): Ruijie WS7204-A branch\_import.php os command injection (CVSS 5.1, Ruijie WS7204-A) - [CVE-2025-9423](https://cve.now/CVE-2025-9423.md): Campcodes Online Water Billing System editecex.php sql injection (CVSS 6.9, Campcodes Online Water Billing System) - [CVE-2025-9422](https://cve.now/CVE-2025-9422.md): oitcode samarium Team Image team cross site scripting (CVSS 4.8, oitcode samarium) - [CVE-2025-9421](https://cve.now/CVE-2025-9421.md): itsourcecode Apartment Management System addcomplain.php sql injection (CVSS 6.9, itsourcecode Apartment Management System) - [CVE-2025-57814](https://cve.now/CVE-2025-57814.md): request-filtering-agent SSRF Bypass via HTTPS Requests (CVSS 5.5, azu request-filtering-agent · request-filtering-agent) - [CVE-2025-9420](https://cve.now/CVE-2025-9420.md): itsourcecode Apartment Management System addfloor.php sql injection (CVSS 6.9, itsourcecode Apartment Management System) - [CVE-2025-57809](https://cve.now/CVE-2025-57809.md): XGrammar affected by Denial of Service by infinite recursion grammars (CVSS 7.7, mlc-ai xgrammar · xgrammar) - [CVE-2025-8627](https://cve.now/CVE-2025-8627.md): Unauthenticated Protocol Commands on TP-Link KP303 (CVSS 8.7, TP-Link Systems TP-Link KP303 (US) Smartplug) - [CVE-2025-57805](https://cve.now/CVE-2025-57805.md): The Scratch Channel's Publish Articles POST Request Can Upload Articles Without Validation (CVSS 8.7, The-Scratch-Channel tsc-web-client) - [CVE-2025-57804](https://cve.now/CVE-2025-57804.md): h2 allows HTTP Request Smuggling due to illegal characters in headers (CVSS 6.9, python-hyper h2 · h2) - [CVE-2025-9419](https://cve.now/CVE-2025-9419.md): itsourcecode Apartment Management System addunit.php sql injection (CVSS 6.9, itsourcecode Apartment Management System) - [CVE-2025-9418](https://cve.now/CVE-2025-9418.md): itsourcecode Apartment Management System addowner.php sql injection (CVSS 6.9, itsourcecode Apartment Management System) - [CVE-2025-6188](https://cve.now/CVE-2025-6188.md): On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do n (CVSS 7.5, Arista Networks EOS) - [CVE-2025-3456](https://cve.now/CVE-2025-3456.md): On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-c (CVSS 3.8, Arista Networks EOS) - [CVE-2025-9417](https://cve.now/CVE-2025-9417.md): itsourcecode Apartment Management System addemployee.php sql injection (CVSS 5.3, itsourcecode Apartment Management System) - [CVE-2025-9416](https://cve.now/CVE-2025-9416.md): oitcode samarium Pages Image webpage cross site scripting (CVSS 4.8, oitcode samarium) - [CVE-2025-9415](https://cve.now/CVE-2025-9415.md): GreenCMS index.php unrestricted upload (CVSS 5.3, GreenCMS) - [CVE-2025-9414](https://cve.now/CVE-2025-9414.md): kalcaddle kodbox Download from Link serverDownload server-side request forgery (CVSS 5.1, kalcaddle kodbox) - [CVE-2025-9413](https://cve.now/CVE-2025-9413.md): lostvip-com ruoyi-go system\_router.go SelectListByPage sql injection (CVSS 5.3, lostvip-com ruoyi-go) - [CVE-2025-57811](https://cve.now/CVE-2025-57811.md): Craft Potential Remote Code Execution via Twig SSTI (CVSS 6.1, craftcms cms · craftcms/cms) - [CVE-2025-57802](https://cve.now/CVE-2025-57802.md): Airlink's Daemon Symlink Vulnerability (CVSS 8.7, airlinklabs daemon) - [CVE-2025-9412](https://cve.now/CVE-2025-9412.md): lostvip-com ruoyi-go DictDataDao.go SelectListByPage sql injection (CVSS 5.3, lostvip-com ruoyi-go) - [CVE-2025-9411](https://cve.now/CVE-2025-9411.md): lostvip-com ruoyi-go LoginInforService.go SelectPageList sql injection (CVSS 5.3, lostvip-com ruoyi-go) - [CVE-2025-57772](https://cve.now/CVE-2025-57772.md): Dataease H2 JDBC RCE Bypass (CVSS 8.2, dataease) - [CVE-2025-57773](https://cve.now/CVE-2025-57773.md): Dataease DB2 Aspectweaver Deserialization Arbitrary File Write Vulnerability (CVSS 8.2, dataease) - [CVE-2025-9410](https://cve.now/CVE-2025-9410.md): lostvip-com ruoyi-go GenTableDao.go SelectListByPage sql injection (CVSS 5.3, lostvip-com ruoyi-go) - [CVE-2025-57760](https://cve.now/CVE-2025-57760.md): Langflow Vulnerable to Privilege Escalation via CLI Superuser Creation (CVSS 8.8, langflow-ai langflow · langflow +1) - [CVE-2025-6737](https://cve.now/CVE-2025-6737.md): Securden Unified PAM Shared SSH Key and Cloud Infrastructure (CVSS 7.2, Securden Unified PAM) - [CVE-2025-53120](https://cve.now/CVE-2025-53120.md): Securden Unified PAM Path Traversal In File Upload (CVSS 9.4, Securden Unified PAM) - [CVE-2025-53119](https://cve.now/CVE-2025-53119.md): Securden Unified PAM Unauthenticated Unrestricted File Upload (CVSS 7.5, Securden Unified PAM) - [CVE-2025-53118](https://cve.now/CVE-2025-53118.md): Securden Unified PAM Authentication Bypass (CVSS 9.8, Securden Unified PAM) - [CVE-2025-9409](https://cve.now/CVE-2025-9409.md): lostvip-com ruoyi-go CommonController.go DownloadUpload path traversal (CVSS 5.3, lostvip-com ruoyi-go) - [CVE-2025-3478](https://cve.now/CVE-2025-3478.md): OpenText Enterprise Security Manager Stored XSS (CVSS 8.5, OpenText Enterprise Security Manager) - [CVE-2025-55301](https://cve.now/CVE-2025-55301.md): The Scratch Channel Allows Username Modification (CVSS 6.7, the-scratch-channel.github.io) - [CVE-2025-5302](https://cve.now/CVE-2025-5302.md): Denial of Service (DOS) in JSONReader in run-llama/llama\_index (CVSS 8.6, run-llama/llama\_index · llama-index-core) - [CVE-2025-46407](https://cve.now/CVE-2025-46407.md): A memory corruption vulnerability exists in the BMPv3 Palette Decoding functionality of the SAIL Image Decoding Library v0.9.8. (CVSS 8.8, SAIL Image Decoding Library) - [CVE-2025-32468](https://cve.now/CVE-2025-32468.md): A memory corruption vulnerability exists in the BMPv3 Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. (CVSS 8.8, SAIL Image Decoding Library) - [CVE-2025-35984](https://cve.now/CVE-2025-35984.md): A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. (CVSS 8.8, SAIL Image Decoding Library) - [CVE-2025-53510](https://cve.now/CVE-2025-53510.md): A memory corruption vulnerability exists in the PSD Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. (CVSS 8.8, SAIL Image Decoding Library) - [CVE-2025-53085](https://cve.now/CVE-2025-53085.md): A memory corruption vulnerability exists in the PSD RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. (CVSS 8.8, SAIL Image Decoding Library) - [CVE-2025-50129](https://cve.now/CVE-2025-50129.md): A memory corruption vulnerability exists in the PCX Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. (CVSS 8.8, SAIL Image Decoding Library) - [CVE-2025-52930](https://cve.now/CVE-2025-52930.md): A memory corruption vulnerability exists in the BMPv3 RLE Decoding functionality of the SAIL Image Decoding Library v0.9.8. (CVSS 8.8, SAIL Image Decoding Library) - [CVE-2025-52456](https://cve.now/CVE-2025-52456.md): A memory corruption vulnerability exists in the WebP Image Decoding functionality of the SAIL Image Decoding Library v0.9.8. (CVSS 8.8, SAIL Image Decoding Library) - [CVE-2025-54370](https://cve.now/CVE-2025-54370.md): PhpSpreadsheet vulnerable to SSRF when reading and displaying a processed HTML document in the browser (CVSS 8.7, PHPOffice PhpSpreadsheet · phpoffice/phpspreadsheet) - [CVE-2025-26467](https://cve.now/CVE-2025-26467.md): Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions (4.0.16 only) (CVSS 8.8, Apache Software Foundation Apache Cassandra · org.apache.ca…) - [CVE-2025-53518](https://cve.now/CVE-2025-53518.md): An integer overflow vulnerability exists in the ABF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa) (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-53853](https://cve.now/CVE-2025-53853.md): A heap-based buffer overflow vulnerability exists in the ISHNE parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-52581](https://cve.now/CVE-2025-52581.md): An integer overflow vulnerability exists in the GDF parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819fa) (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54494](https://cve.now/CVE-2025-54494.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54493](https://cve.now/CVE-2025-54493.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54492](https://cve.now/CVE-2025-54492.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54491](https://cve.now/CVE-2025-54491.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54490](https://cve.now/CVE-2025-54490.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54489](https://cve.now/CVE-2025-54489.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54488](https://cve.now/CVE-2025-54488.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54487](https://cve.now/CVE-2025-54487.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54486](https://cve.now/CVE-2025-54486.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54485](https://cve.now/CVE-2025-54485.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54484](https://cve.now/CVE-2025-54484.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54483](https://cve.now/CVE-2025-54483.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54482](https://cve.now/CVE-2025-54482.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54481](https://cve.now/CVE-2025-54481.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-54480](https://cve.now/CVE-2025-54480.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-53557](https://cve.now/CVE-2025-53557.md): A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-46411](https://cve.now/CVE-2025-46411.md): A stack-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 8.1, The Biosig Project libbiosig) - [CVE-2025-53511](https://cve.now/CVE-2025-53511.md): A heap-based buffer overflow vulnerability exists in the MFER parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-52461](https://cve.now/CVE-2025-52461.md): An out-of-bounds read vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch (35a819f (CVSS 8.2, The Biosig Project libbiosig) - [CVE-2025-54462](https://cve.now/CVE-2025-54462.md): A heap-based buffer overflow vulnerability exists in the Nex parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Branch ( (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-48005](https://cve.now/CVE-2025-48005.md): A heap-based buffer overflow vulnerability exists in the RHS2000 parsing functionality of The Biosig Project libbiosig 3.9.0 and Master Bran (CVSS 9.8, The Biosig Project libbiosig) - [CVE-2025-9407](https://cve.now/CVE-2025-9407.md): mtons mblog profile cross site scripting (CVSS 5.1, mtons mblog) - [CVE-2025-48303](https://cve.now/CVE-2025-48303.md): WordPress Post Type Converter plugin \<= 0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Kevin Langley Jr. Post Type Converter) - [CVE-2025-8562](https://cve.now/CVE-2025-8562.md): Custom Query Shortcode \<= 0.4.0 - Authenticated (Contributor+) Path Traversal via lens Parameter (CVSS 6.5, peterhebert Custom Query Shortcode) - [CVE-2025-7426](https://cve.now/CVE-2025-7426.md): MINOVA TTA Information Disclosure and Credential Exposure (CVSS 9.3, MINOVA Information Services TTA) - [CVE-2025-5191](https://cve.now/CVE-2025-5191.md): Unquoted Search Path Vulnerability in the Utility for Industrial Computers (Windows) (CVSS 7.3, Moxa Utility for DRP-A100 Series · Moxa Utility for DRP-C10…) - [CVE-2025-9118](https://cve.now/CVE-2025-9118.md): Dataform Path Traversal (CVSS 10.0, Google Cloud Dataform) - [CVE-2025-54300](https://cve.now/CVE-2025-54300.md): Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla (CVSS 8.5, norrnext.com Quantum Mamanger component for Joomla) - [CVE-2025-54301](https://cve.now/CVE-2025-54301.md): Extension - norrnext.com - Stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla (CVSS 8.5, norrnext.com Quantum Mamanger component for Joomla) - [CVE-2025-8997](https://cve.now/CVE-2025-8997.md): OpenText Enterprise Security Manager Information Exposure (CVSS 5.7, OpenText Enterprise Security Manager) - [CVE-2025-5514](https://cve.now/CVE-2025-5514.md): Denial-of-Service(DoS) Vulnerability in Web server function on MELSEC iQ-F Series CPU module (CVSS 5.3, Mitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +73) - [CVE-2025-9406](https://cve.now/CVE-2025-9406.md): xuhuisheng lemon CmsArticleController.java uploadImage unrestricted upload (CVSS 5.3, xuhuisheng lemon) - [CVE-2025-9405](https://cve.now/CVE-2025-9405.md): Open5GS gmm-sm.c gmm\_state\_exception assertion (CVSS 6.9, Open5GS) - [CVE-2025-9404](https://cve.now/CVE-2025-9404.md): Scada-LTS Folder pointHierarchySLTS cross site scripting (CVSS 4.8, Scada-LTS) - [CVE-2025-9403](https://cve.now/CVE-2025-9403.md): jqlang jq JSON jq\_test.c run\_jq\_tests assertion (CVSS 4.8, jqlang jq) - [CVE-2025-9402](https://cve.now/CVE-2025-9402.md): HuangDou UTCMS Config update.php server-side request forgery (CVSS 5.1, HuangDou UTCMS) - [CVE-2025-9401](https://cve.now/CVE-2025-9401.md): HuangDou UTCMS Login login.php comparison (CVSS 6.3, HuangDou UTCMS) - [CVE-2025-9400](https://cve.now/CVE-2025-9400.md): YiFang CMS P\_file.php mergeMultipartUpload unrestricted upload (CVSS 5.3, YiFang CMS) - [CVE-2025-9399](https://cve.now/CVE-2025-9399.md): YiFang CMS L\_tool.php sql injection (CVSS 5.3, YiFang CMS) - [CVE-2023-47799](https://cve.now/CVE-2023-47799.md): Mahara before 22.10.4 and 23.x before 23.04.4 allows information disclosure if the experimental HTML bulk export is used via the administrat (CVSS 7.5) - [CVE-2024-39923](https://cve.now/CVE-2024-39923.md): An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7. (CVSS 6.1) - [CVE-2024-46412](https://cve.now/CVE-2024-46412.md): Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sen (CVSS 6.5) - [CVE-2024-46413](https://cve.now/CVE-2024-46413.md): Rebuild v3.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the type parameter in the com.rebuild.web.admin.rbstore.RB (CVSS 5.1) - [CVE-2025-29420](https://cve.now/CVE-2025-29420.md): PerfreeBlog v4.0.11 has a directory traversal vulnerability in the getThemeFilesByName function. (CVSS 7.5) - [CVE-2025-29421](https://cve.now/CVE-2025-29421.md): PerfreeBlog v4.0.11 has an arbitrary file read vulnerability in the getThemeFileContent function. (CVSS 7.5) - [CVE-2025-29514](https://cve.now/CVE-2025-29514.md): Incorrect access control in the config.xgi function of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to downloa (CVSS 9.8) - [CVE-2025-29515](https://cve.now/CVE-2025-29515.md): Incorrect access control in the DELT\_file.xgi endpoint of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to modi (CVSS 9.8) - [CVE-2025-29516](https://cve.now/CVE-2025-29516.md): D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the backup functio (CVSS 7.2) - [CVE-2025-29517](https://cve.now/CVE-2025-29517.md): D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the traceroute6 fu (CVSS 6.8) - [CVE-2025-29519](https://cve.now/CVE-2025-29519.md): A command injection vulnerability in the EXE parameter of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to exec (CVSS 5.3) - [CVE-2025-29520](https://cve.now/CVE-2025-29520.md): Incorrect access control in the Maintenance module of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows authenticated attacke (CVSS 5.3) - [CVE-2025-29521](https://cve.now/CVE-2025-29521.md): Insecure default credentials for the Adminsitrator account of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to (CVSS 5.3) - [CVE-2025-29522](https://cve.now/CVE-2025-29522.md): D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping function. (CVSS 6.5) - [CVE-2025-29523](https://cve.now/CVE-2025-29523.md): D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the ping6 function (CVSS 7.2) - [CVE-2025-29524](https://cve.now/CVE-2025-29524.md): Incorrect access control in the component /cgi-bin/system\_diagnostic\_main.asp of DASAN GPON ONU H660WM H660WMR210825 allows attackers to acc (CVSS 6.5) - [CVE-2025-29525](https://cve.now/CVE-2025-29525.md): DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the m (CVSS 5.3) - [CVE-2025-43960](https://cve.now/CVE-2025-43960.md): Adminer 4.8.1, when using Monolog for logging, allows a Denial of Service (memory consumption) via a crafted serialized payload (e.g., using (CVSS 8.6, vrana/adminer) - [CVE-2025-44178](https://cve.now/CVE-2025-44178.md): DASAN GPON ONU H660WM H660WMR210825 is susceptible to improper access control under its default settings. (CVSS 6.5) - [CVE-2025-44179](https://cve.now/CVE-2025-44179.md): Hitron CGNF-TWN 3.1.1.43-TWN-pre3 contains a command injection vulnerability in the telnet service. (CVSS 6.5) - [CVE-2025-45968](https://cve.now/CVE-2025-45968.md): An issue in System PDV v1.0 allows a remote attacker to obtain sensitive information via the hash parameter in a URL. (CVSS 9.8) - [CVE-2025-50383](https://cve.now/CVE-2025-50383.md): alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order\_by parameter. (CVSS 8.1, alextselegidis/easyappointments) - [CVE-2025-50722](https://cve.now/CVE-2025-50722.md): Insecure Permissions vulnerability in sparkshop v.1.1.7 allows a remote attacker to execute arbitrary code via the Common.php component (CVSS 9.8) - [CVE-2025-50900](https://cve.now/CVE-2025-50900.md): An issue was discovered in getrebuild/rebuild 4.0.4. (CVSS 9.8) - [CVE-2025-51281](https://cve.now/CVE-2025-51281.md): D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en\`, \`val and id parameters in the qj\_asp function. (CVSS 7.0) - [CVE-2025-52130](https://cve.now/CVE-2025-52130.md): File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. (CVSS 5.4) - [CVE-2025-55409](https://cve.now/CVE-2025-55409.md): FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. (CVSS 8.8) - [CVE-2025-55574](https://cve.now/CVE-2025-55574.md): Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code (CVSS 6.1) - [CVE-2025-55575](https://cve.now/CVE-2025-55575.md): SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action= (CVSS 9.8) - [CVE-2025-56212](https://cve.now/CVE-2025-56212.md): phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in add-doctor.php via the docname parameter. (CVSS 9.8) - [CVE-2025-56214](https://cve.now/CVE-2025-56214.md): phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in index.php via the username parameter. (CVSS 9.8) - [CVE-2025-56215](https://cve.now/CVE-2025-56215.md): phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in contact.php via the pagetitle parameter. (CVSS 6.5) - [CVE-2025-56216](https://cve.now/CVE-2025-56216.md): phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection in about-us.php via the pagetitle parameter. (CVSS 8.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-08-25 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.