# CVEs published 2025-08-31 42 CVEs were published on August 31, 2025: 2 critical, 3 high. Days are UTC. - [CVE-2025-9751](https://cve.now/CVE-2025-9751.md): Campcodes Online Learning Management System login.php sql injection (CVSS 6.9, Campcodes Online Learning Management System) - [CVE-2025-9750](https://cve.now/CVE-2025-9750.md): Campcodes Online Learning Management System login.php sql injection (CVSS 6.9, Campcodes Online Learning Management System) - [CVE-2025-9749](https://cve.now/CVE-2025-9749.md): HKritesh009 Grocery List Management Web App update.php sql injection (CVSS 6.9, HKritesh009 Grocery List Management Web App) - [CVE-2025-9748](https://cve.now/CVE-2025-9748.md): Tenda CH22 httpd IPSECsave fromIpsecitem stack-based overflow (CVSS 8.7, Tenda CH22) - [CVE-2025-9747](https://cve.now/CVE-2025-9747.md): Koillection csrf\_protection\_controller.js cross-site request forgery (CVSS 5.3, Koillection) - [CVE-2025-9746](https://cve.now/CVE-2025-9746.md): Campcodes Hospital Management System Edit Doctor Specialization edit-doctor-specialization.php cross site scripting (CVSS 4.8, Campcodes Hospital Management System) - [CVE-2025-9745](https://cve.now/CVE-2025-9745.md): D-Link DI-500WF jhttpd version\_upgrade.asp os command injection (CVSS 5.1, D-Link DI-500WF) - [CVE-2025-9744](https://cve.now/CVE-2025-9744.md): Campcodes Online Loan Management System ajax.php sql injection (CVSS 6.9, Campcodes Online Loan Management System) - [CVE-2025-9743](https://cve.now/CVE-2025-9743.md): code-projects Human Resource Integrated System login\_attendance2.php sql injection (CVSS 6.9, code-projects Human Resource Integrated System) - [CVE-2025-9742](https://cve.now/CVE-2025-9742.md): code-projects Human Resource Integrated System login.php sql injection (CVSS 6.9, code-projects Human Resource Integrated System) - [CVE-2025-9741](https://cve.now/CVE-2025-9741.md): code-projects Human Resource Integrated System login\_query12.php sql injection (CVSS 6.9, code-projects Human Resource Integrated System) - [CVE-2025-9740](https://cve.now/CVE-2025-9740.md): code-projects Human Resource Integrated System log\_query.php sql injection (CVSS 6.9, code-projects Human Resource Integrated System) - [CVE-2025-9739](https://cve.now/CVE-2025-9739.md): Campcodes Online Water Billing System process.php sql injection (CVSS 6.9, Campcodes Online Water Billing System) - [CVE-2025-9738](https://cve.now/CVE-2025-9738.md): Portabilis i-Educar educar\_tipo\_ensino\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-9737](https://cve.now/CVE-2025-9737.md): O2OA Personal Profile importmodel cross site scripting (CVSS 5.1, O2OA) - [CVE-2025-9736](https://cve.now/CVE-2025-9736.md): O2OA Personal Profile statement cross site scripting (CVSS 5.1, O2OA) - [CVE-2025-9735](https://cve.now/CVE-2025-9735.md): O2OA Personal Profile table cross site scripting (CVSS 5.1, O2OA) - [CVE-2025-9734](https://cve.now/CVE-2025-9734.md): O2OA Personal Profile stat cross site scripting (CVSS 5.1, O2OA) - [CVE-2025-9733](https://cve.now/CVE-2025-9733.md): code-projects Human Resource Integrated System login\_timeee.php sql injection (CVSS 6.9, code-projects Human Resource Integrated System) - [CVE-2025-9732](https://cve.now/CVE-2025-9732.md): DCMTK dcm2img diybrpxt.h memory corruption (CVSS 4.8, DCMTK) - [CVE-2025-9731](https://cve.now/CVE-2025-9731.md): Tenda AC9 Administrative shadow hard-coded credentials (CVSS 2.0, Tenda AC9) - [CVE-2025-9730](https://cve.now/CVE-2025-9730.md): itsourcecode Apartment Management System updateProfile.php sql injection (CVSS 6.9, itsourcecode Apartment Management System) - [CVE-2025-9729](https://cve.now/CVE-2025-9729.md): PHPGurukul Online Course Registration student-registration.php sql injection (CVSS 6.9, PHPGurukul Online Course Registration) - [CVE-2025-9728](https://cve.now/CVE-2025-9728.md): givanz Vvveb login.tpl cross site scripting (CVSS 5.3, givanz Vvveb) - [CVE-2025-9727](https://cve.now/CVE-2025-9727.md): D-Link DIR-816L soap.cgi soapcgi\_main os command injection (CVSS 5.3, D-Link DIR-816L) - [CVE-2025-9726](https://cve.now/CVE-2025-9726.md): Campcodes Farm Management System review.php sql injection (CVSS 6.9, Campcodes Farm Management System) - [CVE-2025-9725](https://cve.now/CVE-2025-9725.md): Cudy LT500E Web shadow hard-coded password (CVSS 2.0, Cudy LT500E) - [CVE-2025-9724](https://cve.now/CVE-2025-9724.md): Portabilis i-Educar educar\_nivel\_ensino\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-9723](https://cve.now/CVE-2025-9723.md): Portabilis i-Educar educar\_tipo\_regime\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-9722](https://cve.now/CVE-2025-9722.md): Portabilis i-Educar educar\_tipo\_ocorrencia\_disciplinar\_cad.php cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-9721](https://cve.now/CVE-2025-9721.md): Portabilis i-Educar edit cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-9720](https://cve.now/CVE-2025-9720.md): Portabilis i-Educar Cadastrar tabela de arredondamento edit cross site scripting (CVSS 5.1, Portabilis i-Educar) - [CVE-2025-9719](https://cve.now/CVE-2025-9719.md): O2OA Personal Profile script cross site scripting (CVSS 5.1, O2OA) - [CVE-2025-9718](https://cve.now/CVE-2025-9718.md): O2OA Personal Profile process cross site scripting (CVSS 5.1, O2OA) - [CVE-2025-9717](https://cve.now/CVE-2025-9717.md): O2OA Personal Profile unit cross site scripting (CVSS 5.1, O2OA) - [CVE-2025-9716](https://cve.now/CVE-2025-9716.md): O2OA Personal Profile form cross site scripting (CVSS 5.1, O2OA) - [CVE-2025-5083](https://cve.now/CVE-2025-5083.md): Amministrazione Trasparente \<= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via print\_r Function (CVSS 5.5, milmor Amministrazione Trasparente) - [CVE-2025-31100](https://cve.now/CVE-2025-31100.md): WordPress School Management Plugin \<= 1.93.1 (02-07-2025) - Arbitrary File Upload Vulnerability (CVSS 9.9, Mojoomla School Management) - [CVE-2025-47696](https://cve.now/CVE-2025-47696.md): WordPress Blog Designer PRO plugin \<= 3.4.7 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability (CVSS 8.1, solwin Blog Designer PRO) - [CVE-2024-32832](https://cve.now/CVE-2024-32832.md): WordPress Login with Phone Number plugin \<= 1.6.93 - Broken Access Control vulnerability (CVSS 9.8, Hamid Alinia Login with phone number) - [CVE-2024-32589](https://cve.now/CVE-2024-32589.md): WordPress Barcode Scanner and Inventory manager plugin \<= 1.5.3 - Broken Access Control to XSS vulnerability (CVSS 7.1, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…) - [CVE-2025-9715](https://cve.now/CVE-2025-9715.md): O2OA Personal Profile script cross site scripting (CVSS 5.1, O2OA) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-08-31 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.