# CVEs published 2025-08-27

130 CVEs were published on August 27, 2025: 29 critical, 28 high. Days are UTC.

- [CVE-2024-13979](https://cve.now/CVE-2024-13979.md): St. Joe ERP System SingleRowQueryConverter SQL Injection (CVSS 9.3, Hangzhou Shengqiao Technology Co. St. Joe ERP System)
- [CVE-2024-13982](https://cve.now/CVE-2024-13982.md): SPON IP Network Intercom System rj\_get\_token.php Arbitrary File Read (CVSS 8.7, Changsha SPON Communication Technology Co. SPON IP Network…)
- [CVE-2023-7308](https://cve.now/CVE-2023-7308.md): SecGate3600 Firewall Information Disclosure via authManageSet.cgi (CVSS 8.7, NSFOCUS SecGate3600 Firewall)
- [CVE-2023-7307](https://cve.now/CVE-2023-7307.md): Sangfor Behavior Management System XML External Entity Injection (CVSS 8.7, Sangfor Technologies Co. Sangfor Behavior Management System)
- [CVE-2024-13984](https://cve.now/CVE-2024-13984.md): Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload (CVSS 10.0, Qi'anxin TianQing Management Center)
- [CVE-2024-13981](https://cve.now/CVE-2024-13981.md): LiveBos UploadFile.do Arbitrary File Upload (CVSS 10.0, Fujian Apex Software Co. LiveBOS)
- [CVE-2024-13980](https://cve.now/CVE-2024-13980.md): H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE (CVSS 10.0, H3C Group Intelligent Management Center)
- [CVE-2025-34163](https://cve.now/CVE-2025-34163.md): Dongsheng Logistics Software Unauthenticated Arbitrary File Upload (CVSS 10.0, Qingdao Dongsheng Weiye Software Co. Dongsheng Logistics So…)
- [CVE-2018-25115](https://cve.now/CVE-2018-25115.md): D-Link DIR-110/412/600/615/645/815 RCE via service.cgi (CVSS 10.0, D-Link DIR-110 · D-Link DIR-412 +4)
- [CVE-2023-7309](https://cve.now/CVE-2023-7309.md): Dahua Smart Park Integrated Management Platform Front-End Arbitrary File Upload (CVSS 10.0, Zhejiang Dahua Technology Co. Smart Park Integrated Managem…)
- [CVE-2024-13985](https://cve.now/CVE-2024-13985.md): Dahua EIMS capture\_handle.action RCE (CVSS 10.0, Zhejiang Dahua Technology Co. EIMS)
- [CVE-2025-34162](https://cve.now/CVE-2025-34162.md): Bian Que Feijiu Intelligent Emergency and Quality Control System SQL Injection via GetLyfsByParams (CVSS 9.3, Feijiu Medical Technology Co. Bian Que Feijiu Intelligent E…)
- [CVE-2025-34160](https://cve.now/CVE-2025-34160.md): AnyShare ServiceAgent API Unauthenticated RCE (CVSS 10.0, Shanghai Aishu Information Technology Co. AnyShare)
- [CVE-2025-34520](https://cve.now/CVE-2025-34520.md): Arcserve UDP \< 10.2 Authentication Bypass (CVSS 7.7, Arcserve Unified Data Protection)
- [CVE-2025-34521](https://cve.now/CVE-2025-34521.md): Arcserve UDP \< 10.2 Reflected Cross-Site Scripting (XSS) (CVSS 4.8, Arcserve Unified Data Protection)
- [CVE-2025-34522](https://cve.now/CVE-2025-34522.md): Arcserve UDP \< 10.2 Pre-Authentication Heap Overflow (CVSS 9.2, Arcserve Unified Data Protection)
- [CVE-2025-34523](https://cve.now/CVE-2025-34523.md): Arcserve UDP \< 10.2 Pre-Authentication Heap Overflow (CVSS 9.2, Arcserve Unified Data Protection)
- [CVE-2025-40779](https://cve.now/CVE-2025-40779.md): Kea crash upon interaction between specific client options and subnet selection (CVSS 7.5, ISC Kea)
- [CVE-2025-2246](https://cve.now/CVE-2025-2246.md): Missing Authorization in GitLab (CVSS 5.8, GitLab)
- [CVE-2025-3601](https://cve.now/CVE-2025-3601.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2025-4225](https://cve.now/CVE-2025-4225.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 5.3, GitLab)
- [CVE-2025-5101](https://cve.now/CVE-2025-5101.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 5.0, GitLab)
- [CVE-2025-58050](https://cve.now/CVE-2025-58050.md): PCRE2: heap-buffer-overflow read in match\_ref due to missing boundary restoration in SCS (CVSS 6.9, PCRE2Project pcre2 · pcre2)
- [CVE-2025-58218](https://cve.now/CVE-2025-58218.md): WordPress Small Package Quotes – USPS Edition Plugin \<= 1.3.9 - PHP Object Injection Vulnerability (CVSS 7.2, enituretechnology Small Package Quotes – USPS Edition)
- [CVE-2025-58217](https://cve.now/CVE-2025-58217.md): WordPress Instant Breaking News Plugin \<= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, GeroNikolov Instant Breaking News)
- [CVE-2025-58216](https://cve.now/CVE-2025-58216.md): WordPress WP Thumbtack Review Slider Plugin \<= 2.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, jgwhite33 WP Thumbtack Review Slider)
- [CVE-2025-58213](https://cve.now/CVE-2025-58213.md): WordPress Booking System Trafft Plugin \<= 1.0.14 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, ameliabooking Booking System Trafft)
- [CVE-2025-58212](https://cve.now/CVE-2025-58212.md): WordPress Epeken All Kurir Plugin \<= 2.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Epeken All Kurir)
- [CVE-2025-58211](https://cve.now/CVE-2025-58211.md): WordPress Chatbox Manager Plugin \<= 1.2.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, alexvtn Chatbox Manager)
- [CVE-2025-58209](https://cve.now/CVE-2025-58209.md): WordPress Transcoder Plugin \<= 1.4.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, rtCamp Transcoder)
- [CVE-2025-58208](https://cve.now/CVE-2025-58208.md): WordPress PDF for Elementor Forms + Drag And Drop Template Builder Plugin \<= 6.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, add-ons.org PDF for Elementor Forms + Drag And Drop Templat…)
- [CVE-2025-58205](https://cve.now/CVE-2025-58205.md): WordPress ElementInvader Addons for Elementor Plugin \<= 1.3.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Element Invader ElementInvader Addons for Elementor)
- [CVE-2025-58204](https://cve.now/CVE-2025-58204.md): WordPress Podlove Podcast Publisher Plugin \<= 4.2.5 - Open Redirection Vulnerability (CVSS 4.7, Eric Teubert Podlove Podcast Publisher)
- [CVE-2025-58203](https://cve.now/CVE-2025-58203.md): WordPress Solace Extra Plugin \<= 1.3.2 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.4, solacewp Solace Extra)
- [CVE-2025-58202](https://cve.now/CVE-2025-58202.md): WordPress Simple Page Access Restriction Plugin \<= 1.0.32 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Plugins and Snippets Simple Page Access Restriction)
- [CVE-2025-58201](https://cve.now/CVE-2025-58201.md): WordPress AfterShip Tracking Plugin \<= 1.17.17 - Broken Access Control Vulnerability (CVSS 5.3, AfterShip & Automizely AfterShip Tracking)
- [CVE-2025-58198](https://cve.now/CVE-2025-58198.md): WordPress Xpro Theme Builder Plugin \<= 1.2.9 - Broken Access Control Vulnerability (CVSS 6.5, Xpro Theme Builder)
- [CVE-2025-58197](https://cve.now/CVE-2025-58197.md): WordPress Simple Download Monitor Plugin \<= 3.9.34 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, mra13 Simple Download Monitor)
- [CVE-2025-58196](https://cve.now/CVE-2025-58196.md): WordPress UiCore Elements Plugin \<= 1.3.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, UiCore Elements)
- [CVE-2025-58195](https://cve.now/CVE-2025-58195.md): WordPress Xpro Elementor Addons Plugin \<= 1.4.17 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Xpro Elementor Addons)
- [CVE-2025-58194](https://cve.now/CVE-2025-58194.md): WordPress Bold Page Builder Plugin \<= 5.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, boldthemes Bold Page Builder)
- [CVE-2025-58193](https://cve.now/CVE-2025-58193.md): WordPress Uncanny Automator Plugin \<= 6.7.0.1 - Broken Access Control Vulnerability (CVSS 4.3, Uncanny Owl Uncanny Automator)
- [CVE-2025-58192](https://cve.now/CVE-2025-58192.md): WordPress WP Bulk Delete Plugin \<= 1.3.6 - Broken Access Control Vulnerability (CVSS 4.3, Xylus Themes WP Bulk Delete)
- [CVE-2025-34157](https://cve.now/CVE-2025-34157.md): Coolify Stored Cross-Site Scripting (XSS) in Project Name Field (CVSS 9.4, coolLabs Technologies Coolify)
- [CVE-2025-34159](https://cve.now/CVE-2025-34159.md): Coolify Docker Compose Directive Injection in Application Deployment Workflow (CVSS 9.4, coolLabs Technologies Coolify)
- [CVE-2025-34161](https://cve.now/CVE-2025-34161.md): Coolify Git Repository Field Command Injection in Project Deployment Workflow (CVSS 9.4, coolLabs Technologies Coolify)
- [CVE-2025-57821](https://cve.now/CVE-2025-57821.md): Basecamp's Google Sign-In for Rails allowed redirects to a malformed URL (CVSS 4.2, basecamp google\_sign\_in · google\_sign\_in)
- [CVE-2025-20241](https://cve.now/CVE-2025-20241.md): Cisco Nexus 3000 and 9000 Series Switches IS-IS Protocol \<TBD\> Denial of Service Vulnerability (CVSS 7.4, Cisco NX-OS Software)
- [CVE-2025-20262](https://cve.now/CVE-2025-20262.md): Cisco Nexus 3000 and 9000 Series Switches Protocol Independent Multicast Version 6 Denial of Service Vulnerability (CVSS 5.0, Cisco NX-OS Software)
- [CVE-2025-20290](https://cve.now/CVE-2025-20290.md): Cisco NXOS Software Sensitive Log Information Disclosure Vulnerability (CVSS 5.5, Cisco NX-OS Software · Cisco Unified Computing System)
- [CVE-2025-20292](https://cve.now/CVE-2025-20292.md): Cisco NXOS Software Command Injection Vulnerability (CVSS 4.4, Cisco NX-OS Software · Cisco NX-OS System Software in AC… +1)
- [CVE-2025-20295](https://cve.now/CVE-2025-20295.md): Cisco UCS Manager Software Command Injection Vulnerability (CVSS 6.0, Cisco Unified Computing System)
- [CVE-2025-20294](https://cve.now/CVE-2025-20294.md): Cisco UCS Manager Software Command Injection Vulnerability (CVSS 6.5, Cisco Unified Computing System)
- [CVE-2025-20342](https://cve.now/CVE-2025-20342.md): Cisco Integrated Management Controller Virtual Keyboard Video Monitor (vKVM) Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Unified Computing System)
- [CVE-2025-20317](https://cve.now/CVE-2025-20317.md): Cisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability (CVSS 7.1, Cisco Unified Computing System)
- [CVE-2025-20296](https://cve.now/CVE-2025-20296.md): Cisco UCS Manager Software Stored Software Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Unified Computing System)
- [CVE-2025-20348](https://cve.now/CVE-2025-20348.md): Cisco Nexus Dashboard Unauthorized REST API Vulnerability (CVSS 5.0, Cisco Nexus Dashboard)
- [CVE-2025-20347](https://cve.now/CVE-2025-20347.md): Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability (CVSS 5.4, Cisco Data Center Network Manager)
- [CVE-2025-20344](https://cve.now/CVE-2025-20344.md): Cisco Nexus Dashboard Path Traversal Vulnerability (CVSS 6.5, Cisco Nexus Dashboard)
- [CVE-2025-5187](https://cve.now/CVE-2025-5187.md): Nodes can delete themselves by adding an OwnerReference (CVSS 6.7, Kubernetes · k8s.io/kubernetes)
- [CVE-2025-53105](https://cve.now/CVE-2025-53105.md): GLPI permits unauthorized rules execution order (CVSS 7.5, glpi-project glpi)
- [CVE-2025-9533](https://cve.now/CVE-2025-9533.md): TOTOLINK T10 formLoginAuth.htm improper authentication (CVSS 6.9, TOTOLINK T10)
- [CVE-2025-43729](https://cve.now/CVE-2025-43729.md): Dell ThinOS 10, versions prior to 2508\_10.0127, contains an Incorrect Permission Assignment for Critical Resource vulnerability. (CVSS 7.8, Dell ThinOS)
- [CVE-2025-9532](https://cve.now/CVE-2025-9532.md): Portabilis i-Educar view sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-43730](https://cve.now/CVE-2025-43730.md): Dell ThinOS 10, versions prior to 2508\_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection (CVSS 8.4, Dell ThinOS)
- [CVE-2025-43882](https://cve.now/CVE-2025-43882.md): Dell ThinOS 10, versions prior to 2508\_10.0127, contains an Unverified Ownership vulnerability. (CVSS 7.8, Dell ThinOS)
- [CVE-2025-43728](https://cve.now/CVE-2025-43728.md): Dell ThinOS 10, versions prior to 2508\_10.0127, contain a Protection Mechanism Failure vulnerability. (CVSS 9.6, Dell ThinOS)
- [CVE-2025-9531](https://cve.now/CVE-2025-9531.md): Portabilis i-Educar Agenda agenda.php sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-9529](https://cve.now/CVE-2025-9529.md): Campcodes Payroll Management System index.php include file inclusion (CVSS 6.9, Campcodes Payroll Management System)
- [CVE-2025-9528](https://cve.now/CVE-2025-9528.md): Linksys E1700 systemCommand os command injection (CVSS 5.1, Linksys E1700)
- [CVE-2025-9527](https://cve.now/CVE-2025-9527.md): Linksys E1700 QoSSetup stack-based overflow (CVSS 8.7, Linksys E1700)
- [CVE-2025-9526](https://cve.now/CVE-2025-9526.md): Linksys E1700 setSysAdm stack-based overflow (CVSS 8.7, Linksys E1700)
- [CVE-2025-9525](https://cve.now/CVE-2025-9525.md): Linksys E1700 setWan stack-based overflow (CVSS 8.7, Linksys E1700)
- [CVE-2025-9523](https://cve.now/CVE-2025-9523.md): Tenda AC1206 GetParentControlInfo stack-based overflow (CVSS 9.3, Tenda AC1206)
- [CVE-2025-30064](https://cve.now/CVE-2025-30064.md): Possibility to generate a session for any user via the "ex:action" parameter after obtaining access to the JWT key (CVSS 8.8, CGM CLININET)
- [CVE-2025-30063](https://cve.now/CVE-2025-30063.md): Excessive permissions on configuration files containing database logins and passwords (CVSS 9.4, CGM CLININET)
- [CVE-2025-30061](https://cve.now/CVE-2025-30061.md): SQL injection in utils/Reporter/OpenReportWindow.pl via the UserID parameter (CVSS 6.9, CGM CLININET)
- [CVE-2025-30060](https://cve.now/CVE-2025-30060.md): SQL injection in ReturnUserUnitsXML.pl via the UserID parameter (CVSS 6.9, CGM CLININET)
- [CVE-2025-30059](https://cve.now/CVE-2025-30059.md): Authenticated SQL injection in PrepareCDExportJSON.pl (CVSS 6.9, CGM CLININET)
- [CVE-2025-30058](https://cve.now/CVE-2025-30058.md): SQL injection in getPatientIdentifier function of PatientService.pl (CVSS 6.9, CGM CLININET)
- [CVE-2025-30057](https://cve.now/CVE-2025-30057.md): Authenticated RCE with uhcapache privileges in ConvertToPDF (CVSS 9.4, CGM CLININET)
- [CVE-2025-30056](https://cve.now/CVE-2025-30056.md): Calling system commands via RunCommand (CVSS 9.4, CGM CLININET)
- [CVE-2025-30055](https://cve.now/CVE-2025-30055.md): Conditional RCE via the "system" function (CVSS 9.0, CGM CLININET)
- [CVE-2025-30048](https://cve.now/CVE-2025-30048.md): Unauthenticated access to module configuration endpoint (CVSS 5.3, CGM CLININET)
- [CVE-2025-30041](https://cve.now/CVE-2025-30041.md): Missing authentication in APIs returning statistical data along with session IDs (CVSS 9.0, CGM CLININET)
- [CVE-2025-30040](https://cve.now/CVE-2025-30040.md): Missing authentication in API returning request logs containing session IDs (CVSS 9.0, CGM CLININET)
- [CVE-2025-30039](https://cve.now/CVE-2025-30039.md): Missing authentication in API returning a list of all active sessions (CVSS 9.0, CGM CLININET)
- [CVE-2025-30038](https://cve.now/CVE-2025-30038.md): Session ID leakage in Zone.Identifier of downloaded files (CVSS 7.3, CGM CLININET)
- [CVE-2025-30037](https://cve.now/CVE-2025-30037.md): Missing authentication in APIs allowing data retrieval and modification (CVSS 8.8, CGM CLININET)
- [CVE-2025-30036](https://cve.now/CVE-2025-30036.md): Stored XSS permitting session takeover of arbitrary user (CVSS 8.8, CGM CLININET)
- [CVE-2025-2313](https://cve.now/CVE-2025-2313.md): RCE via Print.pl in uhcPrintServerPrint (CVSS 9.4, CGM CLININET)
- [CVE-2021-4459](https://cve.now/CVE-2021-4459.md): SMA: Directory Traversal in Sunny Boy \<3.10.27.R (CVSS 6.5, SMA Boy)
- [CVE-2025-9514](https://cve.now/CVE-2025-9514.md): macrozheng mall Registration weak password (CVSS 6.3, macrozheng mall)
- [CVE-2025-57797](https://cve.now/CVE-2025-57797.md): Incorrect privilege assignment vulnerability exists in ScanSnap Manager installers versions prior to V6.5L61. (CVSS 7.8, PFU Limited ScanSnap Manager installers)
- [CVE-2025-9513](https://cve.now/CVE-2025-9513.md): editso fuso mod.rs PenetrateRsaAndAesHandshake inadequate encryption (CVSS 6.3, editso fuso)
- [CVE-2025-9511](https://cve.now/CVE-2025-9511.md): itsourcecode Apartment Management System addvisitor.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-57846](https://cve.now/CVE-2025-57846.md): Multiple i-フィルター products contain an issue with incorrect default permissions. (CVSS 7.8, Digital Arts i-フィルター · Digital Arts i-FILTER ブラウザー＆クラウド… +2)
- [CVE-2025-48081](https://cve.now/CVE-2025-48081.md): WordPress Printeers Print & Ship plugin \<= 1.17.0 - Directory Traversal vulnerability (CVSS 5.3, Printeers Print & Ship)
- [CVE-2025-9510](https://cve.now/CVE-2025-9510.md): itsourcecode Apartment Management System addbranch.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9509](https://cve.now/CVE-2025-9509.md): itsourcecode Apartment Management System fair\_info\_all.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9508](https://cve.now/CVE-2025-9508.md): itsourcecode Apartment Management System rented\_info.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9507](https://cve.now/CVE-2025-9507.md): itsourcecode Apartment Management System visitor\_info.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9506](https://cve.now/CVE-2025-9506.md): Campcodes Online Loan Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Loan Management System)
- [CVE-2025-9505](https://cve.now/CVE-2025-9505.md): Campcodes Online Loan Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Loan Management System)
- [CVE-2025-9504](https://cve.now/CVE-2025-9504.md): Campcodes Online Loan Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Loan Management System)
- [CVE-2025-49035](https://cve.now/CVE-2025-49035.md): WordPress Admin Menu Groups plugin \<= 0.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, chaimchaikin Admin Menu Groups)
- [CVE-2025-49039](https://cve.now/CVE-2025-49039.md): WordPress Link View plugin \<= 0.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, mibuthu Link View)
- [CVE-2025-49040](https://cve.now/CVE-2025-49040.md): WordPress Backup Bolt plugin \<= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Backup Bolt)
- [CVE-2025-9503](https://cve.now/CVE-2025-9503.md): Campcodes Online Loan Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Loan Management System)
- [CVE-2025-9502](https://cve.now/CVE-2025-9502.md): Campcodes Online Loan Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Loan Management System)
- [CVE-2025-7732](https://cve.now/CVE-2025-7732.md): Lazy Load for Videos \<= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes (CVSS 6.4, kevinweber Lazy Load for Videos)
- [CVE-2024-37777](https://cve.now/CVE-2024-37777.md): O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function. (CVSS 8.8)
- [CVE-2025-50428](https://cve.now/CVE-2025-50428.md): In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. (CVSS 9.8)
- [CVE-2025-50972](https://cve.now/CVE-2025-50972.md): SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl\_id paramete (CVSS 9.8)
- [CVE-2025-50977](https://cve.now/CVE-2025-50977.md): A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1, requiring authentic (CVSS 6.1)
- [CVE-2025-50978](https://cve.now/CVE-2025-50978.md): In Gitblit v1.7.1, a reflected cross-site scripting (XSS) vulnerability exists in the way repository path names are handled. (CVSS 6.1)
- [CVE-2025-50979](https://cve.now/CVE-2025-50979.md): NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories). (CVSS 8.6, nodebb)
- [CVE-2025-50983](https://cve.now/CVE-2025-50983.md): SQL Injection vulnerability exists in the sortKey parameter of the GET /api/v1/wanted/cutoff API endpoint in readarr 0.4.15.2787. (CVSS 8.3)
- [CVE-2025-50984](https://cve.now/CVE-2025-50984.md): diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration f (CVSS 5.3)
- [CVE-2025-50985](https://cve.now/CVE-2025-50985.md): diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface. (CVSS 5.6)
- [CVE-2025-50986](https://cve.now/CVE-2025-50986.md): diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settings (CVSS 5.6)
- [CVE-2025-50989](https://cve.now/CVE-2025-50989.md): OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint (interfaces\_bridge\_ed (CVSS 9.1, OPNsense)
- [CVE-2025-51667](https://cve.now/CVE-2025-51667.md): An issue was discovered in simple-admin-core v1.2.0 thru v1.6.7. (CVSS 7.0, github.com/suyuan32/simple-admin-core)
- [CVE-2025-52122](https://cve.now/CVE-2025-52122.md): Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vulnerability, resulting in arbit (CVSS 9.8, solspace/craft-freeform)
- [CVE-2025-54598](https://cve.now/CVE-2025-54598.md): The Bevy Event service through 2025-07-22, as used for eBay Seller Events and other activities, allows CSRF to delete all notifications via (CVSS 6.5)
- [CVE-2025-55422](https://cve.now/CVE-2025-55422.md): In FoxCMS 1.2.6, there is a reflected Cross Site Scripting (XSS) vulnerability in /index.php/plus. (CVSS 8.8)
- [CVE-2025-55495](https://cve.now/CVE-2025-55495.md): Tenda AC6 V15.03.06.23\_multi was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function. (CVSS 6.5)
- [CVE-2025-55582](https://cve.now/CVE-2025-55582.md): D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script \`mydlink-watch-dog.sh\`, which blindly respawns binaries su (CVSS 6.6)
- [CVE-2025-55618](https://cve.now/CVE-2025-55618.md): In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app whi (CVSS 7.3)
- [CVE-2025-56694](https://cve.now/CVE-2025-56694.md): Client-side password validation (CWE-602) in lumasoft fotoShare Cloud 2025-03-13 allowing unauthenticated attackers to view password-protect (CVSS 5.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.