# CVEs published 2025-08-29

163 CVEs were published on August 29, 2025: 8 critical, 39 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2025-34165](https://cve.now/CVE-2025-34165.md): NetSupport Manager \< 14.12.0000 Stack-Based Buffer Overflow (CVSS 8.8, NetSupport Manager)
- [CVE-2025-34164](https://cve.now/CVE-2025-34164.md): NetSupport Manager \< 14.12.0000 Heap-Based Buffer Overflow (CVSS 9.3, NetSupport Manager)
- [CVE-2025-58159](https://cve.now/CVE-2025-58159.md): WeGIA Authenticated Arbitrary File Upload Leading To Remote Code Execution (RCE) (CVSS 10.0, LabRedesCefetRJ WeGIA)
- [CVE-2025-57752](https://cve.now/CVE-2025-57752.md): Next.js Affected by Cache Key Confusion for Image Optimization API Routes (CVSS 6.2, vercel next.js · next)
- [CVE-2025-55173](https://cve.now/CVE-2025-55173.md): Next.js Content Injection Vulnerability for Image Optimization (CVSS 4.3, vercel next.js · next)
- [CVE-2025-58156](https://cve.now/CVE-2025-58156.md): Centurion ERP users can view hashed authentication tokens that belong to other users (CVSS 1.9, nofusscomputing centurion\_erp)
- [CVE-2025-57822](https://cve.now/CVE-2025-57822.md): Next.js Improper Middleware Redirect Handling Leads to SSRF (CVSS 6.5, vercel next.js · next)
- [CVE-2025-9678](https://cve.now/CVE-2025-9678.md): Campcodes Online Loan Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Loan Management System)
- [CVE-2025-58160](https://cve.now/CVE-2025-58160.md): Tracing logging user input may result in poisoning logs with ANSI escape sequences (CVSS 2.3, tokio-rs tracing · tracing-subscriber)
- [CVE-2025-58157](https://cve.now/CVE-2025-58157.md): gnark affected by denial of service when computing scalar multiplication using fake-GLV algorithm (CVSS 7.5, Consensys gnark · github.com/consensys/gnark)
- [CVE-2025-58068](https://cve.now/CVE-2025-58068.md): Eventlet affected by HTTP request smuggling in unparsed trailers (CVSS 6.3, eventlet)
- [CVE-2025-58067](https://cve.now/CVE-2025-58067.md): Basecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI (CVSS 4.2, basecamp google\_sign\_in · google\_sign\_in)
- [CVE-2025-9677](https://cve.now/CVE-2025-9677.md): Modo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application components (CVSS 4.8, Modo Legend of the Phoenix)
- [CVE-2025-9676](https://cve.now/CVE-2025-9676.md): NCSOFT Universe App com.ncsoft.universeapp AndroidManifest.xml improper export of android application components (CVSS 4.8, NCSOFT Universe App)
- [CVE-2025-58066](https://cve.now/CVE-2025-58066.md): DoS Vulnerability in ntpd-rs (CVSS 5.3, pendulum-project ntpd-rs · ntpd-rs)
- [CVE-2025-9675](https://cve.now/CVE-2025-9675.md): Voice Changer App com.tuyangkeji.changevoice AndroidManifest.xml improper export of android application components (CVSS 4.8, Voice Changer App)
- [CVE-2025-9674](https://cve.now/CVE-2025-9674.md): Transbyte Scooper News App com.hatsune.eagleee AndroidManifest.xml improper export of android application components (CVSS 4.8, Transbyte Scooper News App)
- [CVE-2025-9673](https://cve.now/CVE-2025-9673.md): Kakao 헤이카카오 Hey Kakao App com.kakao.i.connect AndroidManifest.xml improper export of android application components (CVSS 4.8, 헤이카카오 Hey Kakao App)
- [CVE-2025-9672](https://cve.now/CVE-2025-9672.md): Rejseplanen App de.hafas.android.rejseplanen AndroidManifest.xml improper export of android application components (CVSS 4.8, Rejseplanen App)
- [CVE-2025-9671](https://cve.now/CVE-2025-9671.md): UAB Paytend App com.passport.cash AndroidManifest.xml improper export of android application components (CVSS 4.8, UAB Paytend App)
- [CVE-2025-9670](https://cve.now/CVE-2025-9670.md): mixmark-io turndown commonmark-rules.js redos (CVSS 6.9, mixmark-io turndown)
- [CVE-2025-9669](https://cve.now/CVE-2025-9669.md): Jinher OA GetTreeDate.aspx sql injection (CVSS 6.9, Jinher OA)
- [CVE-2025-43773](https://cve.now/CVE-2025-43773.md): Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 thr (CVSS 4.6, Liferay Portal · Liferay DXP +1)
- [CVE-2025-9667](https://cve.now/CVE-2025-9667.md): code-projects Simple Grading System Admin Panel delete\_account.php sql injection (CVSS 5.3, code-projects Simple Grading System)
- [CVE-2025-9666](https://cve.now/CVE-2025-9666.md): code-projects Simple Grading System Admin Panel delete\_student.php sql injection (CVSS 5.3, code-projects Simple Grading System)
- [CVE-2025-58158](https://cve.now/CVE-2025-58158.md): Harness Affected by Arbitrary File Write in Gitness LFS server (CVSS 8.8, harness · github.com/harness/gitness)
- [CVE-2025-9665](https://cve.now/CVE-2025-9665.md): code-projects Simple Grading System Admin Panel edit\_student.php sql injection (CVSS 5.3, code-projects Simple Grading System)
- [CVE-2025-9377](https://cve.now/CVE-2025-9377.md): Authenticated RCE via Parental Control command injection (CVSS 8.6, KEV, TP-Link Systems Archer C7(EU) · TP-Link Systems TL-WR841N/N…)
- [CVE-2025-52861](https://cve.now/CVE-2025-52861.md): VioStor (CVSS 7.0, QNAP Systems VioStor)
- [CVE-2025-52856](https://cve.now/CVE-2025-52856.md): VioStor (CVSS 9.3, QNAP Systems VioStor)
- [CVE-2025-44015](https://cve.now/CVE-2025-44015.md): HybridDesk Station (CVSS 2.3, QNAP Systems HybridDesk Station)
- [CVE-2025-33038](https://cve.now/CVE-2025-33038.md): Qsync Central (CVSS 7.2, QNAP Systems Qsync Central)
- [CVE-2025-33037](https://cve.now/CVE-2025-33037.md): Qsync Central (CVSS 7.2, QNAP Systems Qsync Central)
- [CVE-2025-33036](https://cve.now/CVE-2025-33036.md): Qsync Central (CVSS 7.2, QNAP Systems Qsync Central)
- [CVE-2025-33033](https://cve.now/CVE-2025-33033.md): Qsync Central (CVSS 7.2, QNAP Systems Qsync Central)
- [CVE-2025-33032](https://cve.now/CVE-2025-33032.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30278](https://cve.now/CVE-2025-30278.md): Qsync Central (CVSS 8.3, QNAP Systems Qsync Central)
- [CVE-2025-30277](https://cve.now/CVE-2025-30277.md): Qsync Central (CVSS 8.3, QNAP Systems Qsync Central)
- [CVE-2025-30275](https://cve.now/CVE-2025-30275.md): Qsync Central (CVSS 5.3, QNAP Systems Qsync Central)
- [CVE-2025-30274](https://cve.now/CVE-2025-30274.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30273](https://cve.now/CVE-2025-30273.md): QTS, QuTS hero (CVSS 7.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30272](https://cve.now/CVE-2025-30272.md): QTS, QuTS hero (CVSS 5.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30271](https://cve.now/CVE-2025-30271.md): QTS, QuTS hero (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30270](https://cve.now/CVE-2025-30270.md): QTS, QuTS hero (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30268](https://cve.now/CVE-2025-30268.md): QTS, QuTS hero (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30267](https://cve.now/CVE-2025-30267.md): QTS, QuTS hero (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30265](https://cve.now/CVE-2025-30265.md): QTS, QuTS hero (CVSS 2.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30264](https://cve.now/CVE-2025-30264.md): QTS, QuTS hero (CVSS 7.7, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-30263](https://cve.now/CVE-2025-30263.md): Qsync Central (CVSS 5.3, QNAP Systems Qsync Central)
- [CVE-2025-30262](https://cve.now/CVE-2025-30262.md): Qsync Central (CVSS 5.3, QNAP Systems Qsync Central)
- [CVE-2025-30261](https://cve.now/CVE-2025-30261.md): Qsync Central (CVSS 7.1, QNAP Systems Qsync Central)
- [CVE-2025-30260](https://cve.now/CVE-2025-30260.md): Qsync Central (CVSS 7.1, QNAP Systems Qsync Central)
- [CVE-2025-29900](https://cve.now/CVE-2025-29900.md): File Station 5 (CVSS 7.1, QNAP Systems File Station)
- [CVE-2025-29899](https://cve.now/CVE-2025-29899.md): File Station 5 (CVSS 7.1, QNAP Systems File Station)
- [CVE-2025-29898](https://cve.now/CVE-2025-29898.md): Qsync Central (CVSS 6.0, QNAP Systems Qsync Central)
- [CVE-2025-29894](https://cve.now/CVE-2025-29894.md): Qsync Central (CVSS 7.5, QNAP Systems Qsync Central)
- [CVE-2025-29893](https://cve.now/CVE-2025-29893.md): Qsync Central (CVSS 7.5, QNAP Systems Qsync Central)
- [CVE-2025-29890](https://cve.now/CVE-2025-29890.md): File Station 5 (CVSS 7.1, QNAP Systems File Station)
- [CVE-2025-29889](https://cve.now/CVE-2025-29889.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-29888](https://cve.now/CVE-2025-29888.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-29887](https://cve.now/CVE-2025-29887.md): QuRouter 2.5 (CVSS 7.1, QNAP Systems QuRouter)
- [CVE-2025-29886](https://cve.now/CVE-2025-29886.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-29882](https://cve.now/CVE-2025-29882.md): QTS, QuTS hero (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2025-29879](https://cve.now/CVE-2025-29879.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-29878](https://cve.now/CVE-2025-29878.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-29875](https://cve.now/CVE-2025-29875.md): File Station 5 (CVSS 7.1, QNAP Systems File Station)
- [CVE-2025-29874](https://cve.now/CVE-2025-29874.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-22483](https://cve.now/CVE-2025-22483.md): License Center (CVSS 7.1, QNAP Systems License Center)
- [CVE-2024-12923](https://cve.now/CVE-2024-12923.md): Photo Station (CVSS 2.0, QNAP Systems Photo Station)
- [CVE-2025-9664](https://cve.now/CVE-2025-9664.md): code-projects Simple Grading System Admin Panel add\_student\_grade.php sql injection (CVSS 5.3, code-projects Simple Grading System)
- [CVE-2025-9663](https://cve.now/CVE-2025-9663.md): code-projects Simple Grading System Admin Panel edit\_account.php sql injection (CVSS 5.3, code-projects Simple Grading System)
- [CVE-2025-9662](https://cve.now/CVE-2025-9662.md): code-projects Simple Grading System Admin Panel login.php sql injection (CVSS 6.9, code-projects Simple Grading System)
- [CVE-2025-9660](https://cve.now/CVE-2025-9660.md): SourceCodester Bakeshop Online Ordering System passwordrecover.php sql injection (CVSS 6.9, SourceCodester Bakeshop Online Ordering System)
- [CVE-2025-9659](https://cve.now/CVE-2025-9659.md): O2OA Personal Profile widget cross site scripting (CVSS 5.1, O2OA)
- [CVE-2025-9658](https://cve.now/CVE-2025-9658.md): O2OA Personal Profile dict cross site scripting (CVSS 5.1, O2OA)
- [CVE-2025-47909](https://cve.now/CVE-2025-47909.md): Improper validation of TrustedOrigins allows CSRF attacks in github.com/gorilla/csrf (CVSS 7.3, github.com/gorilla/csrf)
- [CVE-2025-55750](https://cve.now/CVE-2025-55750.md): Gitpod Classic Affected by Bitbucket OAuth Token Exposure via Redirect Fragment (CVSS 6.5, gitpod-io gitpod)
- [CVE-2025-55177](https://cve.now/CVE-2025-55177.md): Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25 (CVSS 5.4, KEV, Facebook WhatsApp Desktop for Mac · Facebook WhatsApp Bu… +1)
- [CVE-2025-5808](https://cve.now/CVE-2025-5808.md): Authentication Bypass vulnerability discovered in the OpenText™ Self-Service Password Reset (CVSS 7.3, OpenText Self Service Password Reset)
- [CVE-2025-55202](https://cve.now/CVE-2025-55202.md): Opencast has a partial path traversal vulnerability in UI config (CVSS 2.7, opencast · org.opencastproject:opencast-user-interface-conf…)
- [CVE-2025-9657](https://cve.now/CVE-2025-9657.md): O2OA Personal Profile script cross site scripting (CVSS 5.1, O2OA)
- [CVE-2025-9656](https://cve.now/CVE-2025-9656.md): PHPGurukul Directory Management System add-directory.php cross site scripting (CVSS 5.3, PHPGurukul Directory Management System)
- [CVE-2025-54877](https://cve.now/CVE-2025-54877.md): Tuleap's special and always there fields permissions are not verified in cross-tracker search (CVSS 5.3, Enalean tuleap)
- [CVE-2025-9655](https://cve.now/CVE-2025-9655.md): O2OA Personal Profile person cross site scripting (CVSS 5.1, O2OA)
- [CVE-2025-9654](https://cve.now/CVE-2025-9654.md): AiondaDotCom mcp-ssh server-simple.mjs command injection (CVSS 5.3, AiondaDotCom mcp-ssh · @aiondadotcom/mcp-ssh)
- [CVE-2025-55304](https://cve.now/CVE-2025-55304.md): Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata (CVSS 1.8, exiv2)
- [CVE-2025-54080](https://cve.now/CVE-2025-54080.md): Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file (CVSS 1.8, exiv2)
- [CVE-2025-9653](https://cve.now/CVE-2025-9653.md): Portabilis i-Educar Cadastrar projeto educar\_projeto\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-9652](https://cve.now/CVE-2025-9652.md): Portabilis i-Educar Cadastrar tipo de transferência educar\_transferencia\_tipo\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar)
- [CVE-2025-9651](https://cve.now/CVE-2025-9651.md): shafhasan chatbox chat.php sql injection (CVSS 5.3, shafhasan chatbox)
- [CVE-2025-9650](https://cve.now/CVE-2025-9650.md): yeqifu carRental AppFileUtils.java removeFileByPath path traversal (CVSS 5.3, yeqifu carRental)
- [CVE-2025-9649](https://cve.now/CVE-2025-9649.md): appneta tcpreplay send\_packets.c calc\_sleep\_time divide by zero (CVSS 4.8, appneta tcpreplay)
- [CVE-2025-9647](https://cve.now/CVE-2025-9647.md): mtons mblog list cross site scripting (CVSS 5.3, mtons mblog)
- [CVE-2025-9646](https://cve.now/CVE-2025-9646.md): O2OA calendarConfig cross site scripting (CVSS 5.1, O2OA)
- [CVE-2025-9645](https://cve.now/CVE-2025-9645.md): itsourcecode Apartment Management System r\_all\_info.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9644](https://cve.now/CVE-2025-9644.md): itsourcecode Apartment Management System bill\_setup.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9643](https://cve.now/CVE-2025-9643.md): itsourcecode Apartment Management System utility\_bill\_setup.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-40709](https://cve.now/CVE-2025-40709.md): Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH (CVSS 5.1, ACDH-CH OpenAtlas)
- [CVE-2025-40708](https://cve.now/CVE-2025-40708.md): Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH (CVSS 5.1, ACDH-CH OpenAtlas)
- [CVE-2025-40707](https://cve.now/CVE-2025-40707.md): Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH (CVSS 5.1, ACDH-CH OpenAtlas)
- [CVE-2025-40706](https://cve.now/CVE-2025-40706.md): Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH (CVSS 5.1, ACDH-CH OpenAtlas)
- [CVE-2025-40705](https://cve.now/CVE-2025-40705.md): Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH (CVSS 5.1, ACDH-CH OpenAtlas)
- [CVE-2025-40704](https://cve.now/CVE-2025-40704.md): Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH (CVSS 5.1, ACDH-CH OpenAtlas)
- [CVE-2025-40703](https://cve.now/CVE-2025-40703.md): Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH (CVSS 5.1, ACDH-CH OpenAtlas)
- [CVE-2025-40702](https://cve.now/CVE-2025-40702.md): Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH (CVSS 5.1, ACDH-CH OpenAtlas)
- [CVE-2025-9217](https://cve.now/CVE-2025-9217.md): Slider Revolution \<= 6.7.36 - Authenticated (Contributor+) Arbitrary File Read via 'used\_svg' and 'used\_images' (CVSS 6.5, Revolution Slider Slider Revolution)
- [CVE-2024-13342](https://cve.now/CVE-2024-13342.md): Booster for WooCommerce \<= 7.2.4 - Unauthenticated Double Extension Arbitrary File Upload (CVSS 8.1, pluggabl Booster for WooCommerce – PDF Invoices, Abandoned…)
- [CVE-2025-4644](https://cve.now/CVE-2025-4644.md): User Session Fixation after Account Removal in PayloadCMS (CVSS 5.3, Payload CMS Payload · payload +2)
- [CVE-2025-4643](https://cve.now/CVE-2025-4643.md): Lack of JWT Expiration after Log Out in PayloadCMS (CVSS 6.3, Payload CMS Payload · payload +2)
- [CVE-2025-9071](https://cve.now/CVE-2025-9071.md): Insecure RSA-OAEP implementation with all-zero seed for padding in Oberon PSA Crypto (CVSS 2.3, Oberon microsystems AG Oberon PSA Crypto)
- [CVE-2025-7383](https://cve.now/CVE-2025-7383.md): Timing side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in Oberon PSA Crypto library (CVSS 5.9, Oberon microsystems AG Oberon PSA Crypto)
- [CVE-2025-7071](https://cve.now/CVE-2025-7071.md): Timing side-channel vulnerability in AES-CBC decryption with PKCS#7 padding in ocrypto library (CVSS 5.9, Oberon microsystems AG ocrypto)
- [CVE-2025-8150](https://cve.now/CVE-2025-8150.md): Events Addon for Elementor \<= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter and Countdown Widgets (CVSS 6.4, nicheaddons Events Addon for Elementor)
- [CVE-2024-13987](https://cve.now/CVE-2024-13987.md): Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote a (CVSS 5.9, Synology RADIUS Server)
- [CVE-2025-54777](https://cve.now/CVE-2025-54777.md): Uncaught exception issue exists in Multiple products in bizhub series. (CVSS 4.3, Konica Minolta Multiple products in bizhub series)
- [CVE-2025-9441](https://cve.now/CVE-2025-9441.md): iATS Online Forms \<= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter (CVSS 6.5, iatspaymentsdev iATS Online Forms)
- [CVE-2025-8290](https://cve.now/CVE-2025-8290.md): List Subpages \<= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter (CVSS 6.4, weblineindia List Sub Pages)
- [CVE-2025-8619](https://cve.now/CVE-2025-8619.md): OSM Map Widget for Elementor \<= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL (CVSS 6.4, garbowza OSM Map Widget for Elementor)
- [CVE-2025-9374](https://cve.now/CVE-2025-9374.md): Ultimate Tag Warrior Importer \<= 0.2 - Cross-Site Request Forgery (CVSS 4.3, briancolinger Ultimate Tag Warrior Importer)
- [CVE-2025-8147](https://cve.now/CVE-2025-8147.md): LWSCache \<= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache\_activatePlugin Function (CVSS 4.3, aurelienlws LWSCache)
- [CVE-2025-53508](https://cve.now/CVE-2025-53508.md): Multiple products provided by iND Co.,Ltd contain an OS command injection vulnerability. (CVSS 7.2, iND Co. HL330-DLS · iND Co. HL320-DLS +7)
- [CVE-2025-53507](https://cve.now/CVE-2025-53507.md): Multiple products provided by iND Co.,Ltd contain an insecure storage of sensitive information vulnerability. (CVSS 6.5, iND Co. HL330-DLS · iND Co. HL320-DLS +7)
- [CVE-2025-9619](https://cve.now/CVE-2025-9619.md): E4 Sistemas Mercatus ERP id resource injection (CVSS 6.9, E4 Sistemas Mercatus ERP)
- [CVE-2025-9639](https://cve.now/CVE-2025-9639.md): Ai3｜QbiCRMGateway - Arbitrary File Reading through Path Traversal (CVSS 8.7, Ai3 QbiCRMGateway)
- [CVE-2025-8858](https://cve.now/CVE-2025-8858.md): Changing｜Clinic Image System - SQL Injection (CVSS 8.7, Changing Clinic Image System)
- [CVE-2025-8857](https://cve.now/CVE-2025-8857.md): Changing｜Clinic Image System - Use of Hard-coded Credentials (CVSS 9.3, Changing Clinic Image System)
- [CVE-2025-9610](https://cve.now/CVE-2025-9610.md): code-projects Online Event Judging System create\_account.php sql injection (CVSS 6.9, code-projects Online Event Judging System)
- [CVE-2025-9609](https://cve.now/CVE-2025-9609.md): Portabilis i-Educar consulta improper authorization (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-8861](https://cve.now/CVE-2025-8861.md): Changing｜TSA - Missing Authentication (CVSS 9.3, Changing TSA)
- [CVE-2025-9608](https://cve.now/CVE-2025-9608.md): Portabilis i-Educar Formula de Cálculo de Média view sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-9607](https://cve.now/CVE-2025-9607.md): Portabilis i-Educar Tabelas de Arredondamento view sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-9606](https://cve.now/CVE-2025-9606.md): Portabilis i-Educar agenda\_preferencias.php sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-9605](https://cve.now/CVE-2025-9605.md): Tenda AC21/AC23 GetParentControlInfo stack-based overflow (CVSS 9.3, Tenda AC21 · Tenda AC23)
- [CVE-2025-58323](https://cve.now/CVE-2025-58323.md): NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\\SYSTEM by executing arbitra (CVSS 7.7, NAVER MYBOX Explorer)
- [CVE-2025-39247](https://cve.now/CVE-2025-39247.md): There is an Access Control Vulnerability in some HikCentral Professional versions. (CVSS 8.6, Hikvision HikCentral Professional)
- [CVE-2025-39246](https://cve.now/CVE-2025-39246.md): There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. (CVSS 5.3, Hikvision HikCentral FocSign)
- [CVE-2025-39245](https://cve.now/CVE-2025-39245.md): There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. (CVSS 4.7, Hikvision HikCentral Master Lite)
- [CVE-2025-9604](https://cve.now/CVE-2025-9604.md): coze-studio aes.go hard-coded key (CVSS 6.3, coze-studio)
- [CVE-2025-9603](https://cve.now/CVE-2025-9603.md): Telesquare TLR-2005KSH internet.cgi command injection (CVSS 5.3, Telesquare TLR-2005KSH)
- [CVE-2025-9602](https://cve.now/CVE-2025-9602.md): Xinhu RockOA index.php publicsaveAjax improper authorization (CVSS 5.3, Xinhu RockOA)
- [CVE-2025-9601](https://cve.now/CVE-2025-9601.md): itsourcecode Apartment Management System employee\_salary\_setup.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9600](https://cve.now/CVE-2025-9600.md): itsourcecode Apartment Management System member\_type\_setup.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9599](https://cve.now/CVE-2025-9599.md): itsourcecode Apartment Management System month\_setup.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2024-54554](https://cve.now/CVE-2024-54554.md): This issue was addressed with improved handling of symlinks. (CVSS 5.5, Apple macOS)
- [CVE-2025-43187](https://cve.now/CVE-2025-43187.md): This issue was addressed by removing the vulnerable code. (CVSS 7.8, Apple macOS)
- [CVE-2025-43284](https://cve.now/CVE-2025-43284.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 5.5, Apple macOS)
- [CVE-2024-54568](https://cve.now/CVE-2024-54568.md): The issue was addressed with improved memory handling. (CVSS 4.3, Apple macOS)
- [CVE-2024-44271](https://cve.now/CVE-2024-44271.md): The issue was addressed with improved checks. (CVSS 3.3, Apple macOS)
- [CVE-2025-43268](https://cve.now/CVE-2025-43268.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2025-43255](https://cve.now/CVE-2025-43255.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 3.3, Apple macOS)
- [CVE-2025-40927](https://cve.now/CVE-2025-40927.md): CGI::Simple versions 1.281 and earlier for Perl has a HTTP response splitting flaw (CVSS 7.3, MANWAR CGI::Simple)
- [CVE-2025-9598](https://cve.now/CVE-2025-9598.md): itsourcecode Apartment Management System year\_setup.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2025-9597](https://cve.now/CVE-2025-9597.md): itsourcecode Apartment Management System rented\_all\_info.php sql injection (CVSS 6.9, itsourcecode Apartment Management System)
- [CVE-2023-41471](https://cve.now/CVE-2023-41471.md): Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the (CVSS 7.8, copyparty)
- [CVE-2024-46484](https://cve.now/CVE-2024-46484.md): TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component. (CVSS 9.8)
- [CVE-2024-46916](https://cve.now/CVE-2024-46916.md): Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR06 contains functionality that allows the removal of critical system files before the (CVSS 8.1)
- [CVE-2024-46917](https://cve.now/CVE-2024-46917.md): Diebold Nixdorf Vynamic Security Suite through 4.3.0 SR01 does not validate file attributes or the contents of /root during integrity valida (CVSS 8.1)
- [CVE-2025-44033](https://cve.now/CVE-2025-44033.md): SQL injection vulnerability in oa\_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the allDirector() method declara (CVSS 9.8)
- [CVE-2025-54142](https://cve.now/CVE-2025-54142.md): Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subseque (CVSS 4.0, AkamaiGhost)
- [CVE-2025-55579](https://cve.now/CVE-2025-55579.md): SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. (CVSS 5.4)
- [CVE-2025-55580](https://cve.now/CVE-2025-55580.md): SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. (CVSS 5.4)
- [CVE-2025-55763](https://cve.now/CVE-2025-55763.md): Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a cra (CVSS 7.5)
- [CVE-2025-56577](https://cve.now/CVE-2025-56577.md): An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys. (CVSS 8.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.