# CVEs published 2025-08-30

44 CVEs were published on August 30, 2025: 9 critical, 7 high. Days are UTC.

- [CVE-2025-9706](https://cve.now/CVE-2025-9706.md): SourceCodester Water Billing System edit.php sql injection (CVSS 6.9, SourceCodester Water Billing System)
- [CVE-2025-9705](https://cve.now/CVE-2025-9705.md): SourceCodester Water Billing System paybill.php sql injection (CVSS 6.9, SourceCodester Water Billing System)
- [CVE-2025-9704](https://cve.now/CVE-2025-9704.md): SourceCodester Water Billing System viewbill.php sql injection (CVSS 6.9, SourceCodester Water Billing System)
- [CVE-2025-9702](https://cve.now/CVE-2025-9702.md): SourceCodester Simple Cafe Billing System sales\_report.php sql injection (CVSS 6.9, SourceCodester Simple Cafe Billing System)
- [CVE-2025-9701](https://cve.now/CVE-2025-9701.md): SourceCodester Simple Cafe Billing System receipt.php sql injection (CVSS 6.9, SourceCodester Simple Cafe Billing System)
- [CVE-2025-9700](https://cve.now/CVE-2025-9700.md): SourceCodester Online Book Store publisher\_list.php sql injection (CVSS 6.9, SourceCodester Online Book Store)
- [CVE-2025-9699](https://cve.now/CVE-2025-9699.md): SourceCodester Online Polling System Code checklogin.php sql injection (CVSS 6.9, SourceCodester Online Polling System Code)
- [CVE-2025-9695](https://cve.now/CVE-2025-9695.md): GalleryVault Gallery Vault App com.thinkyeah.galleryvault AndroidManifest.xml improper export of android application components (CVSS 4.8, GalleryVault Gallery Vault App)
- [CVE-2025-9694](https://cve.now/CVE-2025-9694.md): Campcodes Advanced Online Voting System login.php sql injection (CVSS 6.9, Campcodes Advanced Online Voting System)
- [CVE-2025-9692](https://cve.now/CVE-2025-9692.md): Campcodes Online Shopping System product.php sql injection (CVSS 6.9, Campcodes Online Shopping System)
- [CVE-2025-9691](https://cve.now/CVE-2025-9691.md): Campcodes Online Shopping System login.php sql injection (CVSS 6.9, Campcodes Online Shopping System)
- [CVE-2012-10062](https://cve.now/CVE-2012-10062.md): XAMPP WebDAV PHP Upload Authentication Bypass RCE (CVSS 8.7, Apache Friends XAMPP)
- [CVE-2010-10017](https://cve.now/CVE-2010-10017.md): WM Downloader 3.1.2.2 Buffer Overflow via Malformed M3U File (CVSS 8.4, WM Downloader)
- [CVE-2011-10032](https://cve.now/CVE-2011-10032.md): Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57 (CVSS 9.3, Sunway ForceControl)
- [CVE-2009-20008](https://cve.now/CVE-2009-20008.md): Green Dam 3.17 URL Processing Buffer Overflow (CVSS 8.6, Zhengzhou Jinhui Computer System Engineering Co. Ltd. ; Bei…)
- [CVE-2009-20010](https://cve.now/CVE-2009-20010.md): Dogfood CRM spell.php RCE (CVSS 9.3, Dogfood CRM)
- [CVE-2009-20011](https://cve.now/CVE-2009-20011.md): ContentKeeper Web Appliance \< 125.10 RCE via mimencode (CVSS 10.0, ContentKeeper Technologies ContentKeeper Web Appliance)
- [CVE-2005-10004](https://cve.now/CVE-2005-10004.md): Cacti graph\_view.php RCE via graph\_start Parameter Injection (CVSS 8.7, Raxnet/Ian Berry Cacti)
- [CVE-2010-10016](https://cve.now/CVE-2010-10016.md): BS.Player 2.57 Buffer Overflow via M3U Playlist Import (CVSS 10.0, BS.Player Free and Pro Editions)
- [CVE-2009-20009](https://cve.now/CVE-2009-20009.md): Belkin Bulldog Plus Web Service Buffer Overflow (CVSS 9.3, Belkin International Bulldog Plus UPS Monitoring Software)
- [CVE-2008-20001](https://cve.now/CVE-2008-20001.md): activePDF WebGrabber ActiveX Control Buffer Overflow (CVSS 7.5, activePDF WebGrabber)
- [CVE-2025-9690](https://cve.now/CVE-2025-9690.md): SourceCodester Advanced School Management System vendordetails sql injection (CVSS 5.3, SourceCodester Advanced School Management System)
- [CVE-2025-9689](https://cve.now/CVE-2025-9689.md): SourceCodester Advanced School Management System item\_select sql injection (CVSS 5.3, SourceCodester Advanced School Management System)
- [CVE-2025-0165](https://cve.now/CVE-2025-0165.md): IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data SQL injection (CVSS 7.6, watsonx Orchestrate Cartridge for IBM Cloud Pak for Data)
- [CVE-2025-9688](https://cve.now/CVE-2025-9688.md): Mupen64Plus is\_viewer.c write\_is\_viewer integer overflow (CVSS 2.3, Mupen64Plus)
- [CVE-2025-9687](https://cve.now/CVE-2025-9687.md): Portabilis i-Educar processamentoApi improper authorization (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-9686](https://cve.now/CVE-2025-9686.md): Portabilis i-Educar Listagem de áreas de conhecimento edit sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-9685](https://cve.now/CVE-2025-9685.md): Portabilis i-Educar Listagem de áreas de conhecimento view sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-9684](https://cve.now/CVE-2025-9684.md): Portabilis i-Educar Formula de Cálculo de Média edit sql injection (CVSS 5.3, Portabilis i-Educar)
- [CVE-2025-9683](https://cve.now/CVE-2025-9683.md): O2OA Personal Profile form cross site scripting (CVSS 5.1, O2OA)
- [CVE-2025-9682](https://cve.now/CVE-2025-9682.md): O2OA Personal Profile appdict cross site scripting (CVSS 5.1, O2OA)
- [CVE-2025-38677](https://cve.now/CVE-2025-38677.md): f2fs: fix to avoid out-of-boundary access in dnode page (CVSS 7.8, Linux)
- [CVE-2025-9681](https://cve.now/CVE-2025-9681.md): O2OA Personal Profile agent cross site scripting (CVSS 5.1, O2OA)
- [CVE-2025-9680](https://cve.now/CVE-2025-9680.md): O2OA Personal Profile page cross site scripting (CVSS 5.1, O2OA)
- [CVE-2025-9679](https://cve.now/CVE-2025-9679.md): itsourcecode Student Information System course\_edit1.php sql injection (CVSS 6.9, itsourcecode Student Information System)
- [CVE-2025-9500](https://cve.now/CVE-2025-9500.md): TablePress \<= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode\_debug Parameter (CVSS 6.4, tobiasbg TablePress – Tables in WordPress made easy)
- [CVE-2025-9499](https://cve.now/CVE-2025-9499.md): Ocean Extra \<= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via oceanwp\_library Shortcode (CVSS 6.4, oceanwp Ocean Extra)
- [CVE-2025-54946](https://cve.now/CVE-2025-54946.md): SUNNET Corporate Training Management System - SQL Injection (CVSS 9.3, SUNNET Technology Co. Corporate Training Management System)
- [CVE-2025-54945](https://cve.now/CVE-2025-54945.md): SUNNET Corporate Training Management System - External Control of File Name or Path (CVSS 10.0, SUNNET Technology Co. Corporate Training Management System)
- [CVE-2025-54944](https://cve.now/CVE-2025-54944.md): SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type (CVSS 6.9, SUNNET Technology Co. Corporate Training Management System)
- [CVE-2025-54943](https://cve.now/CVE-2025-54943.md): SUNNET Corporate Training Management System - Missing Authorization (CVSS 9.3, SUNNET Technology Co. Corporate Training Management System)
- [CVE-2025-54942](https://cve.now/CVE-2025-54942.md): SUNNET Corporate Training Management System - Missing Authentication for Critical Function (CVSS 9.3, SUNNET Technology Co. Corporate Training Management System)
- [CVE-2025-4956](https://cve.now/CVE-2025-4956.md): WordPress Pro Bulk Watermark Plugin for WordPress Theme \<= 2.0 - Path Traversal Vulnerability (CVSS 4.3, AA-Team Pro Bulk Watermark Plugin for WordPress)
- [CVE-2025-9618](https://cve.now/CVE-2025-9618.md): Related Posts Lite \<= 1.12 - Cross-Site Request Forgery (CVSS 4.3, wpdreams Related Posts Lite)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.