CVEs published August 27, 2025
130 CVEs were published on August 27, 2025: 29 critical, 28 high.
- Published
- 130
- Critical
- 29
- High
- 28
- Medium
- 73
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- CGM CLININET
- 17
- Campcodes Online Loan Management System
- 5
- Cisco Unified Computing System
- 5
- itsourcecode Apartment Management System
- 5
- Arcserve Unified Data Protection
- 4
- Dell ThinOS
- 4
- GitLab
- 4
- Linksys E1700
- 4
- coolLabs Technologies Coolify
- 3
- Cisco Nexus Dashboard
- 2
Critical 29
- CVE-2024-13979St. Joe ERP System SingleRowQueryConverter SQL InjectionHangzhou Shengqiao Technology Co. St. Joe ERP System
- CVE-2024-13984Qi'anxin TianQing Management Center rptsvr Arbitrary File UploadQi'anxin TianQing Management Center
- CVE-2024-13981LiveBos UploadFile.do Arbitrary File UploadFujian Apex Software Co. LiveBOS
- CVE-2024-13980H3C Intelligent Management Center (iMC) /byod/index.xhtml RCEH3C Group Intelligent Management Center
- CVE-2025-34163Dongsheng Logistics Software Unauthenticated Arbitrary File UploadQingdao Dongsheng Weiye Software Co. Dongsheng Logistics So…
- CVE-2018-25115D-Link DIR-110/412/600/615/645/815 RCE via service.cgiD-Link DIR-110 · D-Link DIR-412 +4
- CVE-2023-7309Dahua Smart Park Integrated Management Platform Front-End Arbitrary File UploadZhejiang Dahua Technology Co. Smart Park Integrated Managem…
- CVE-2024-13985Dahua EIMS capture_handle.action RCEZhejiang Dahua Technology Co. EIMS
- CVE-2025-34162Bian Que Feijiu Intelligent Emergency and Quality Control System SQL Injection via GetLyfsByParamsFeijiu Medical Technology Co. Bian Que Feijiu Intelligent E…
- CVE-2025-34160AnyShare ServiceAgent API Unauthenticated RCEShanghai Aishu Information Technology Co. AnyShare
- CVE-2025-34522Arcserve UDP < 10.2 Pre-Authentication Heap OverflowArcserve Unified Data Protection
- CVE-2025-34523Arcserve UDP < 10.2 Pre-Authentication Heap OverflowArcserve Unified Data Protection
- CVE-2025-34157Coolify Stored Cross-Site Scripting (XSS) in Project Name FieldcoolLabs Technologies Coolify
- CVE-2025-34159Coolify Docker Compose Directive Injection in Application Deployment WorkflowcoolLabs Technologies Coolify
- CVE-2025-34161Coolify Git Repository Field Command Injection in Project Deployment WorkflowcoolLabs Technologies Coolify
- CVE-2025-43728Dell ThinOS 10, versions prior to 2508_10.0127, contain a Protection Mechanism Failure vulnerability.Dell ThinOS
- CVE-2025-9523Tenda AC1206 GetParentControlInfo stack-based overflowTenda AC1206
- CVE-2025-30063Excessive permissions on configuration files containing database logins and passwordsCGM CLININET
- CVE-2025-30057Authenticated RCE with uhcapache privileges in ConvertToPDFCGM CLININET
- CVE-2025-30056Calling system commands via RunCommandCGM CLININET
- CVE-2025-30055Conditional RCE via the "system" functionCGM CLININET
- CVE-2025-30041Missing authentication in APIs returning statistical data along with session IDsCGM CLININET
- CVE-2025-30040Missing authentication in API returning request logs containing session IDsCGM CLININET
- CVE-2025-30039Missing authentication in API returning a list of all active sessionsCGM CLININET
- CVE-2025-2313RCE via Print.pl in uhcPrintServerPrintCGM CLININET
- CVE-2025-50428In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script.
- CVE-2025-50972SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id paramete
- CVE-2025-50989OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces_bridge_edOPNsense
- CVE-2025-52122Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbitsolspace/craft-freeform
High 28
- CVE-2024-13982SPON IP Network Intercom System rj_get_token.php Arbitrary File ReadChangsha SPON Communication Technology Co. SPON IP Network…
- CVE-2023-7308SecGate3600 Firewall Information Disclosure via authManageSet.cgiNSFOCUS SecGate3600 Firewall
- CVE-2023-7307Sangfor Behavior Management System XML External Entity InjectionSangfor Technologies Co. Sangfor Behavior Management System
- CVE-2025-34520Arcserve UDP < 10.2 Authentication BypassArcserve Unified Data Protection
- CVE-2025-40779Kea crash upon interaction between specific client options and subnet selectionISC Kea
- CVE-2025-58218WordPress Small Package Quotes – USPS Edition Plugin <= 1.3.9 - PHP Object Injection Vulnerabilityenituretechnology Small Package Quotes – USPS Edition
- CVE-2025-58217WordPress Instant Breaking News Plugin <= 1.0 - Cross Site Request Forgery (CSRF) VulnerabilityGeroNikolov Instant Breaking News
- CVE-2025-20241Cisco Nexus 3000 and 9000 Series Switches IS-IS Protocol <TBD> Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2025-20317Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect VulnerabilityCisco Unified Computing System
- CVE-2025-53105GLPI permits unauthorized rules execution orderglpi-project glpi
- CVE-2025-43729Dell ThinOS 10, versions prior to 2508_10.0127, contains an Incorrect Permission Assignment for Critical Resource vulnerability.Dell ThinOS
- CVE-2025-43730Dell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument InjectionDell ThinOS
- CVE-2025-43882Dell ThinOS 10, versions prior to 2508_10.0127, contains an Unverified Ownership vulnerability.Dell ThinOS
- CVE-2025-9527Linksys E1700 QoSSetup stack-based overflowLinksys E1700
- CVE-2025-9526Linksys E1700 setSysAdm stack-based overflowLinksys E1700
- CVE-2025-9525Linksys E1700 setWan stack-based overflowLinksys E1700
- CVE-2025-30064Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT keyCGM CLININET
- CVE-2025-30038Session ID leakage in Zone.Identifier of downloaded filesCGM CLININET
- CVE-2025-30037Missing authentication in APIs allowing data retrieval and modificationCGM CLININET
- CVE-2025-30036Stored XSS permitting session takeover of arbitrary userCGM CLININET
- CVE-2025-57797Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61.PFU Limited ScanSnap Manager installers
- CVE-2025-57846Multiple i-フィルター products contain an issue with incorrect default permissions.Digital Arts i-フィルター · Digital Arts i-FILTER ブラウザー＆クラウド… +2
- CVE-2024-37777O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.
- CVE-2025-50979NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories).nodebb
- CVE-2025-50983SQL Injection vulnerability exists in the sortKey parameter of the GET /api/v1/wanted/cutoff API endpoint in readarr 0.4.15.2787.
- CVE-2025-51667An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7.github.com/suyuan32/simple-admin-core
- CVE-2025-55422In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus.
- CVE-2025-55618In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app whi
Medium, low and unrated 73
- CVE-2025-34521Arcserve UDP < 10.2 Reflected Cross-Site Scripting (XSS)Arcserve Unified Data Protection
- CVE-2025-2246Missing Authorization in GitLabGitLab
- CVE-2025-3601Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-4225Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-5101Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2025-58050PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCSPCRE2Project pcre2 · pcre2
- CVE-2025-58216WordPress WP Thumbtack Review Slider Plugin <= 2.6 - Cross Site Scripting (XSS) Vulnerabilityjgwhite33 WP Thumbtack Review Slider
- CVE-2025-58213WordPress Booking System Trafft Plugin <= 1.0.14 - Cross Site Scripting (XSS) Vulnerabilityameliabooking Booking System Trafft
- CVE-2025-58212WordPress Epeken All Kurir Plugin <= 2.0.1 - Cross Site Scripting (XSS) VulnerabilityEpeken All Kurir
- CVE-2025-58211WordPress Chatbox Manager Plugin <= 1.2.6 - Cross Site Scripting (XSS) Vulnerabilityalexvtn Chatbox Manager
- CVE-2025-58209WordPress Transcoder Plugin <= 1.4.0 - Cross Site Scripting (XSS) VulnerabilityrtCamp Transcoder
- CVE-2025-58208WordPress PDF for Elementor Forms + Drag And Drop Template Builder Plugin <= 6.2.0 - Cross Site Scripting (XSS) Vulnerabilityadd-ons.org PDF for Elementor Forms + Drag And Drop Templat…
- CVE-2025-58205WordPress ElementInvader Addons for Elementor Plugin <= 1.3.6 - Cross Site Scripting (XSS) VulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2025-58204WordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection VulnerabilityEric Teubert Podlove Podcast Publisher
- CVE-2025-58203WordPress Solace Extra Plugin <= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerabilitysolacewp Solace Extra
- CVE-2025-58202WordPress Simple Page Access Restriction Plugin <= 1.0.32 - Cross Site Request Forgery (CSRF) VulnerabilityPlugins and Snippets Simple Page Access Restriction
- CVE-2025-58201WordPress AfterShip Tracking Plugin <= 1.17.17 - Broken Access Control VulnerabilityAfterShip & Automizely AfterShip Tracking
- CVE-2025-58198WordPress Xpro Theme Builder Plugin <= 1.2.9 - Broken Access Control VulnerabilityXpro Theme Builder
- CVE-2025-58197WordPress Simple Download Monitor Plugin <= 3.9.34 - Cross Site Scripting (XSS) Vulnerabilitymra13 Simple Download Monitor
- CVE-2025-58196WordPress UiCore Elements Plugin <= 1.3.4 - Cross Site Scripting (XSS) VulnerabilityUiCore Elements
- CVE-2025-58195WordPress Xpro Elementor Addons Plugin <= 1.4.17 - Cross Site Scripting (XSS) VulnerabilityXpro Elementor Addons
- CVE-2025-58194WordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) Vulnerabilityboldthemes Bold Page Builder
- CVE-2025-58193WordPress Uncanny Automator Plugin <= 6.7.0.1 - Broken Access Control VulnerabilityUncanny Owl Uncanny Automator
- CVE-2025-58192WordPress WP Bulk Delete Plugin <= 1.3.6 - Broken Access Control VulnerabilityXylus Themes WP Bulk Delete
- CVE-2025-57821Basecamp's Google Sign-In for Rails allowed redirects to a malformed URLbasecamp google_sign_in · google_sign_in
- CVE-2025-20262Cisco Nexus 3000 and 9000 Series Switches Protocol Independent Multicast Version 6 Denial of Service VulnerabilityCisco NX-OS Software
- CVE-2025-20290Cisco NXOS Software Sensitive Log Information Disclosure VulnerabilityCisco NX-OS Software · Cisco Unified Computing System
- CVE-2025-20292Cisco NXOS Software Command Injection VulnerabilityCisco NX-OS Software · Cisco NX-OS System Software in AC… +1
- CVE-2025-20295Cisco UCS Manager Software Command Injection VulnerabilityCisco Unified Computing System
- CVE-2025-20294Cisco UCS Manager Software Command Injection VulnerabilityCisco Unified Computing System
- CVE-2025-20342Cisco Integrated Management Controller Virtual Keyboard Video Monitor (vKVM) Stored Cross-Site Scripting VulnerabilityCisco Unified Computing System
- CVE-2025-20296Cisco UCS Manager Software Stored Software Stored Cross-Site Scripting VulnerabilityCisco Unified Computing System
- CVE-2025-20348Cisco Nexus Dashboard Unauthorized REST API VulnerabilityCisco Nexus Dashboard
- CVE-2025-20347Cisco Nexus Dashboard Fabric Controller Unauthorized REST API VulnerabilityCisco Data Center Network Manager
- CVE-2025-20344Cisco Nexus Dashboard Path Traversal VulnerabilityCisco Nexus Dashboard
- CVE-2025-5187Nodes can delete themselves by adding an OwnerReferenceKubernetes · k8s.io/kubernetes
- CVE-2025-9533TOTOLINK T10 formLoginAuth.htm improper authenticationTOTOLINK T10
- CVE-2025-9532Portabilis i-Educar view sql injectionPortabilis i-Educar
- CVE-2025-9531Portabilis i-Educar Agenda agenda.php sql injectionPortabilis i-Educar
- CVE-2025-9529Campcodes Payroll Management System index.php include file inclusionCampcodes Payroll Management System
- CVE-2025-9528Linksys E1700 systemCommand os command injectionLinksys E1700
- CVE-2025-30061SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameterCGM CLININET
- CVE-2025-30060SQL injection in ReturnUserUnitsXML.pl via the UserID parameterCGM CLININET
- CVE-2025-30059Authenticated SQL injection in PrepareCDExportJSON.plCGM CLININET
- CVE-2025-30058SQL injection in getPatientIdentifier function of PatientService.plCGM CLININET
- CVE-2025-30048Unauthenticated access to module configuration endpointCGM CLININET
- CVE-2021-4459SMA: Directory Traversal in Sunny Boy <3.10.27.RSMA Boy
- CVE-2025-9514macrozheng mall Registration weak passwordmacrozheng mall
- CVE-2025-9513editso fuso mod.rs PenetrateRsaAndAesHandshake inadequate encryptioneditso fuso
- CVE-2025-9511itsourcecode Apartment Management System addvisitor.php sql injectionitsourcecode Apartment Management System
- CVE-2025-48081WordPress Printeers Print & Ship plugin <= 1.17.0 - Directory Traversal vulnerabilityPrinteers Print & Ship
- CVE-2025-9510itsourcecode Apartment Management System addbranch.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9509itsourcecode Apartment Management System fair_info_all.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9508itsourcecode Apartment Management System rented_info.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9507itsourcecode Apartment Management System visitor_info.php sql injectionitsourcecode Apartment Management System
- CVE-2025-9506Campcodes Online Loan Management System ajax.php sql injectionCampcodes Online Loan Management System
- CVE-2025-9505Campcodes Online Loan Management System ajax.php sql injectionCampcodes Online Loan Management System
- CVE-2025-9504Campcodes Online Loan Management System ajax.php sql injectionCampcodes Online Loan Management System
- CVE-2025-49035WordPress Admin Menu Groups plugin <= 0.1.2 - Cross Site Scripting (XSS) vulnerabilitychaimchaikin Admin Menu Groups
- CVE-2025-49039WordPress Link View plugin <= 0.8.0 - Cross Site Scripting (XSS) vulnerabilitymibuthu Link View
- CVE-2025-49040WordPress Backup Bolt plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerabilityBackup Bolt
- CVE-2025-9503Campcodes Online Loan Management System ajax.php sql injectionCampcodes Online Loan Management System
- CVE-2025-9502Campcodes Online Loan Management System ajax.php sql injectionCampcodes Online Loan Management System
- CVE-2025-7732Lazy Load for Videos <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributeskevinweber Lazy Load for Videos
- CVE-2025-50977A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1, requiring authentic
- CVE-2025-50978In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vulnerability exists in the way repository path names are handled.
- CVE-2025-50984diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration f
- CVE-2025-50985diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface.
- CVE-2025-50986diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settings
- CVE-2025-54598The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via
- CVE-2025-55495Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function.
- CVE-2025-55582D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly respawns binaries su
- CVE-2025-56694Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protect