Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2025

328 records · 12 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 4

  • CVE-2025-24000
    35Monitor

    WordPress Post SMTP plugin <= 3.2.0 - Account Takeover Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 0%

    saad iqbal · post smtpAug 7, 2025

  • CVE-2025-34152
    63This week

    Shenzhen Aitemi M300 Wi-Fi Repeater OS Command Injection via Time Parameter

    CriticalCVSS 9.4WeaponizedEPSS 86%

    shenzhen aitemi e commerce co. ltd. · m300 wi-fi repeaterAug 7, 2025

  • CVE-2025-50675
    31Monitor

    GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory.

    HighCVSS 7.8Proof of conceptEPSS 0%

    Aug 7, 2025

  • CVE-2025-54793
    22Monitor

    Astro: Duplicate trailing slash feature can lead to Open Redirects

    MediumCVSS 5.5Proof of conceptEPSS 0%

    astro · astroAug 7, 2025

  • CVE-2025-54887
    36Monitor

    jwe: Missing AES-GCM authentication tag validation in encrypted JWEs

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    jwt · ruby-jweAug 7, 2025

  • CVE-2025-8088
    91Now

    Path traversal vulnerability in WinRAR

    HighCVSS 8.4KEVWeaponizedEPSS 94%

    rarlab · winrarAug 8, 2025

  • CVE-2025-8730
    36Monitor

    Belkin F9K1009/F9K1010 Web Interface hard-coded credentials

    HighCVSS 8.9Proof of conceptEPSS 3%

    belkin · f9k1009Aug 8, 2025

  • CVE-2025-4576
    27Monitor

    A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q

    MediumCVSS 6.9Proof of conceptEPSS 0%

    liferay · digital experience platformAug 8, 2025

  • CVE-2025-8356
    45Plan

    Path Traversal leading to RCE

    CriticalCVSS 9.8No exploitEPSS 19%

    xerox · freeflow coreAug 8, 2025

  • CVE-2025-52913
    39Monitor

    A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    Aug 8, 2025

  • CVE-2025-52914
    35Monitor

    A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticate

    HighCVSS 8.8Proof of conceptEPSS 0%

    mitel · micollabAug 8, 2025

  • CVE-2025-5095
    37Monitor

    Burk Technology ARC Solo Missing Authentication for Critical Function

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    burk technology · arc soloAug 8, 2025

  • CVE-2010-10013
    60This week

    AjaXplorer < 2.6 checkInstall.php Unauthenticated RCE

    CriticalCVSS 9.3WeaponizedEPSS 1%

    ajaxplorer · ajaxplorerAug 8, 2025

  • CVE-2012-10036
    60This week

    Project Pier <= 0.8.8 Arbitrary File Upload RCE

    CriticalCVSS 9.3WeaponizedEPSS 1%

    projectpier · projectpierAug 8, 2025

  • CVE-2012-10041
    60This week

    WAN Emulator v2.3 Command Execution

    CriticalCVSS 9.3WeaponizedEPSS 4%

    wan emulator · wan emulatorAug 8, 2025

  • CVE-2012-10042
    40Plan

    Sflog! CMS 1.0 Arbitrary File Upload RCE

    HighCVSS 8.7WeaponizedEPSS 1%

    sflog! · sflog! cmsAug 8, 2025

  • CVE-2012-10043
    40Plan

    ActFax 4.32 Client Importer Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 0%

    actfax · serverAug 8, 2025

  • CVE-2012-10044
    60This week

    MobileCartly 1.0 savepage.php Arbitrary File Creation

    CriticalCVSS 10.0WeaponizedEPSS 1%

    mobilecartly · mobilecartlyAug 8, 2025

  • CVE-2012-10045
    60This week

    XODA 0.4.5 Arbitrary PHP File Upload

    CriticalCVSS 9.3WeaponizedEPSS 1%

    xoda · xodaAug 8, 2025

  • CVE-2012-10046
    60This week

    E-Mail Security Virtual Appliance learn-msg.cgi Command Injection

    CriticalCVSS 9.3WeaponizedEPSS 4%

    esva-project · e-mail security virtual applianceAug 8, 2025

  • CVE-2012-10047
    60This week

    Cyclope Employee Surveillance Solution v6.x SQL Injection

    CriticalCVSS 10.0WeaponizedEPSS 1%

    cyclope-series · cyclope employee surveillance solutionAug 8, 2025

  • CVE-2012-10048
    40Plan

    Zenoss 3.x showDaemonXMLConfig Command Execution

    HighCVSS 8.7WeaponizedEPSS 3%

    zenoss, inc. · zenoss coreAug 8, 2025

  • CVE-2012-10049
    60This week

    WebPageTest Arbitrary PHP File Upload RCE

    CriticalCVSS 9.3WeaponizedEPSS 1%

    wpo foundation · webpagetestAug 8, 2025

  • CVE-2012-10050
    60This week

    CuteFlow <= 2.11.2 Arbitrary File Upload RCE

    CriticalCVSS 9.3WeaponizedEPSS 1%

    cuteflow.org · cuteflowAug 8, 2025

  • CVE-2012-10051
    40Plan

    Photodex ProShow Producer 5.0.3256 load File Handling Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    photodex corporation · proshow producerAug 8, 2025

  • CVE-2012-10052
    60This week

    EGallery 1.2 Arbitrary PHP File Upload

    CriticalCVSS 9.3WeaponizedEPSS 1%

    egallery · egalleryAug 8, 2025

  • CVE-2012-10053
    60This week

    Simple Web Server Connection Header Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 1%

    pmsoftware · simple web serverAug 8, 2025

  • CVE-2025-4796
    35Monitor

    Eventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account Takeover

    HighCVSS 8.8Proof of conceptEPSS 0%

    themewinter · eventinAug 8, 2025

  • CVE-2025-55188
    14Monitor

    7-Zip before 25.01 does not always properly handle symbolic links during extraction.

    LowCVSS 3.6Proof of conceptEPSS 0%

    7-zip · 7-zipAug 8, 2025

  • CVE-2025-7020
    20Monitor

    BYD DiLink OS Incorrect encryption Implementation of system log dumps

    MediumCVSS 5.1No exploitEPSS 0%

    byd · dilink osAug 9, 2025

  • CVE-2025-52136
    12Monitor

    In EMQX before 5.8.6, administrators can install arbitrary novel plugins via the Dashboard web interface.

    LowCVSS 3.0Proof of conceptEPSS 0%

    emqx · emqxAug 10, 2025

  • CVE-2012-10037
    60This week

    PhpTax pfilez Parameter Exec Remote Code Injection

    CriticalCVSS 9.3WeaponizedEPSS 1%

    phptax · phptaxAug 11, 2025

  • CVE-2012-10038
    60This week

    Auxilium RateMyPet Arbitrary File Upload RCE

    CriticalCVSS 9.3WeaponizedEPSS 1%

    auxilium · ratemypetAug 11, 2025

  • CVE-2012-10039
    40Plan

    ZEN Load Balancer Filelog Command Execution

    CriticalCVSS 9.4WeaponizedEPSS 3%

    zen load balancer · zen load balancerAug 11, 2025

  • CVE-2012-10040
    40Plan

    Openfiler v2.x NetworkCard Command Execution

    CriticalCVSS 9.4WeaponizedEPSS 3%

    openfiler · openfilerAug 11, 2025

  • CVE-2025-25231
    37Monitor

    Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability.

    HighCVSS 7.5Proof of conceptEPSS 23%

    omnissa · omnissa workspace one uemAug 11, 2025

  • CVE-2024-32640
    62This week

    MasaCMS SQL Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 77%

    masacms · masacmsAug 11, 2025

  • CVE-2025-55150
    40Plan

    Stirling-PDF SSRF vulnerability on /api/v1/convert/html/pdf

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    stirlingpdf · stirling pdfAug 11, 2025

  • CVE-2025-55161
    40Plan

    Stirling-PDF SSRF vulnerability on /api/v1/convert/markdown/pdf

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    stirlingpdf · stirling pdfAug 11, 2025

  • CVE-2025-42957
    39Monitor

    Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    sap_se · sap s/4hana (private cloud or on-premise)Aug 11, 2025

  • CVE-2025-8081
    19Monitor

    Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import

    MediumCVSS 4.9Proof of conceptEPSS 0%

    elementor · website builderAug 12, 2025

  • CVE-2025-40766
    27Monitor

    A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0).

    MediumCVSS 6.8Proof of conceptEPSS 0%

    siemens · sinec traffic analyzerAug 12, 2025

  • CVE-2025-24999
    36Monitor

    Microsoft SQL Server Elevation of Privilege Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 1%

    microsoft · sql server 2016Aug 12, 2025

  • CVE-2025-49712
    41Plan

    Microsoft SharePoint Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 20%

    microsoft · sharepoint serverAug 12, 2025

  • CVE-2025-50154
    35Monitor

    Microsoft Windows File Explorer Spoofing Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 29%

    microsoft · windows 10 1507Aug 12, 2025

  • CVE-2025-50165
    42Plan

    Windows Graphics Component Remote Code Execution Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 10%

    microsoft · windows 11 24h2Aug 12, 2025

  • CVE-2025-50168
    31Monitor

    Win32k Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 0%

    microsoft · windows 11 22h2Aug 12, 2025

  • CVE-2025-53136
    22Monitor

    NT OS Kernel Information Disclosure Vulnerability

    MediumCVSS 5.5Proof of conceptEPSS 0%

    microsoft · windows 10 1507Aug 12, 2025

  • CVE-2025-53722
    37Monitor

    Windows Remote Desktop Services Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 22%

    microsoft · windows 10 1507Aug 12, 2025

  • CVE-2025-53760
    34Monitor

    Microsoft SharePoint Elevation of Privilege Vulnerability

    HighCVSS 7.1No exploitEPSS 18%

    microsoft · sharepoint serverAug 12, 2025

  • CVE-2025-53772
    43Plan

    Web Deploy Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 27%

    microsoft · web deploy 4.0Aug 12, 2025

  • CVE-2025-53778
    50Plan

    Windows NTLM Elevation of Privilege Vulnerability

    HighCVSS 8.8No exploitEPSS 51%

    microsoft · windows 10 1507Aug 12, 2025

  • CVE-2025-53779
    29Monitor

    Windows Kerberos Elevation of Privilege Vulnerability

    HighCVSS 7.2Proof of conceptEPSS 2%

    microsoft · windows server 2025Aug 12, 2025

  • CVE-2025-53783
    30Monitor

    Microsoft Teams Remote Code Execution Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 0%

    microsoft · dynamics 365 guidesAug 12, 2025

  • CVE-2025-25256
    59Plan

    An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortin

    CriticalCVSS 9.8Proof of conceptEPSS 65%

    fortinet · fortisiemAug 12, 2025

  • CVE-2025-52970
    35Monitor

    A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.

    HighCVSS 8.1Proof of conceptEPSS 10%

    fortinet · fortiwebAug 12, 2025

  • CVE-2025-55169
    40Plan

    WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'

    CriticalCVSS 10.0Proof of conceptEPSS 1%

    wegia · wegiaAug 12, 2025

  • CVE-2025-7384
    39Monitor

    Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    crmperks · database for contact form 7, wpforms, elementor formsAug 13, 2025

  • CVE-2025-8760
    37Monitor

    INSTAR 2K+/4K fcgi_server base64_decode buffer overflow

    CriticalCVSS 9.3Proof of conceptEPSS 0%

    instar · 2k+Aug 13, 2025

  • CVE-2025-8671
    31Monitor

    A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2

    HighCVSS 7.5Proof of conceptEPSS 3%

    suse linux · enterprise module for development toolsAug 13, 2025

  • CVE-2025-52392
    21Monitor

    Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    Aug 13, 2025

  • CVE-2025-55668
    26Monitor

    Apache Tomcat: session fixation via rewrite valve

    MediumCVSS 6.5Proof of conceptEPSS 0%

    apache · tomcatAug 13, 2025

  • CVE-2025-55163
    32Monitor

    Netty MadeYouReset HTTP/2 DDoS Vulnerability

    HighCVSS 8.2Proof of conceptEPSS 1%

    netty · nettyAug 13, 2025

  • CVE-2025-52385
    39Monitor

    An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process mo

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    Aug 13, 2025

  • CVE-2025-50946
    26Monitor

    OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.

    MediumCVSS 6.5Proof of conceptEPSS 1%

    olivetin · olivetinAug 13, 2025

  • CVE-2025-8924
    22Monitor

    Campcodes Online Water Billing System viewbill.php sql injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    campcodes · online water billing systemAug 13, 2025

  • CVE-2011-10009
    60This week

    S40 CMS 0.4.2 Path Traversal

    HighCVSS 8.7WeaponizedEPSS 1%

    s40 cms · s40 cmsAug 13, 2025

  • CVE-2011-10010
    40Plan

    QuickShare File Server 1.2.1 Path Traversal RCE

    CriticalCVSS 9.4WeaponizedEPSS 2%

    quicksharehq · quickshare file serverAug 13, 2025

  • CVE-2011-10011
    60This week

    WeBid 1.0.2 converter.php Remote PHP Code Injection

    CriticalCVSS 10.0WeaponizedEPSS 2%

    webid · webidAug 13, 2025

  • CVE-2011-10012
    40Plan

    NetOp Remote Control Client 9.5 .dws File Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    netop · remote control clientAug 13, 2025

  • CVE-2011-10013
    60This week

    Traq 2.0–2.3 admincp/common.php RCE

    CriticalCVSS 10.0WeaponizedEPSS 2%

    traq project · issue tracking systemAug 13, 2025

  • CVE-2011-10014
    40Plan

    GTA SA-MP server.cfg Buffer Overflow

    HighCVSS 8.7WeaponizedEPSS 0%

    sa-mp team · san andreas multiplayerAug 13, 2025

  • CVE-2011-10015
    40Plan

    Cytel Studio <= 9.0 .CY3 File Stack Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 0%

    cytel inc. · cytel studioAug 13, 2025

  • CVE-2011-10016
    40Plan

    Real Networks Netzip Classic 7.5.1.86 File Parsing Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 0%

    realnetworks inc. · netzip classicAug 13, 2025

  • CVE-2011-10017
    60This week

    Snort Report nmap.php/nbtscan.php RCE

    CriticalCVSS 10.0WeaponizedEPSS 2%

    symmetrix technologies · snort reportAug 13, 2025

  • CVE-2011-10018
    60This week

    myBB 1.6.4 Backdoor Arbitrary Command Execution

    CriticalCVSS 10.0WeaponizedEPSS 2%

    mybb · mybbAug 13, 2025

  • CVE-2012-10054
    60This week

    Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

    CriticalCVSS 9.3WeaponizedEPSS 4%

    umbraco · umbraco cmsAug 13, 2025

  • CVE-2012-10055
    60This week

    ComSndFTP v1.3.7 Beta USER Format String RCE

    CriticalCVSS 9.3WeaponizedEPSS 2%

    comsndftp · ftp serverAug 13, 2025

  • CVE-2012-10056
    40Plan

    PHP Volunteer Management System 1.0.2 Arbitrary File Upload

    HighCVSS 8.7WeaponizedEPSS 1%

    php volunteer management · php volunteer managementAug 13, 2025

  • CVE-2012-10057
    40Plan

    Lattice Semiconductor ispVM System 18.0.2 XCF File Handling Buffer Overflow

    HighCVSS 8.4WeaponizedEPSS 0%

    lattice semiconductor · ispvm systemAug 13, 2025

  • CVE-2012-10058
    60This week

    RabidHamster R4 Log Entry sprintf() Buffer Overflow

    CriticalCVSS 10.0WeaponizedEPSS 2%

    rabidhamster · r4 embedded serverAug 13, 2025

  • CVE-2012-10059
    40Plan

    Dolibarr ERP/CRM Post-Auth OS Command Injection

    CriticalCVSS 9.4WeaponizedEPSS 4%

    dolibarr project · erp/crmAug 13, 2025

  • CVE-2012-10060
    60This week

    Sysax Multi Server < 5.55 SSH Username Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 4%

    sysax · multi serverAug 13, 2025

  • CVE-2011-10019
    60This week

    Spreecommerce < 0.60.2 Search Parameter RCE

    CriticalCVSS 10.0WeaponizedEPSS 5%

    spreecommerce · spreeAug 13, 2025

  • CVE-2025-0309
    24Monitor

    Netskope Client Local Elevation of Privileges

    MediumCVSS 6.0Proof of conceptEPSS 0%

    netskope · netskope clientAug 14, 2025

  • CVE-2025-55346
    46Plan

    Unintended dynamic code execution leads to remote code execution by network attackers

    CriticalCVSS 9.8No exploitEPSS 22%

    Aug 14, 2025

  • CVE-2025-8943
    62This week

    Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

    CriticalCVSS 9.8WeaponizedEPSS 75%

    flowiseai · flowiseAug 14, 2025

  • CVE-2025-8956
    15Monitor

    D-Link DIR‑818L ssdpcgi cgibin getenv command injection

    LowCVSS 2.1No exploitEPSS 23%

    dlink · dir-818l firmwareAug 14, 2025

  • CVE-2025-8714
    35Monitor

    PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client

    HighCVSS 8.8Proof of conceptEPSS 0%

    Aug 14, 2025

  • CVE-2024-53945
    42Plan

    The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/at

    HighCVSS 8.8No exploitEPSS 23%

    Aug 14, 2025

  • CVE-2025-43984
    46Plan

    An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211).

    CriticalCVSS 9.8No exploitEPSS 23%

    Aug 14, 2025

  • CVE-2025-8875
    68This week

    Insecure Deserialization Vulnerability

    CriticalCVSS 9.4KEVWeaponizedEPSS 1%

    n-able · n-centralAug 14, 2025

  • CVE-2025-8876
    68This week

    Command Injection Vulnerability

    CriticalCVSS 9.4KEVWeaponizedEPSS 3%

    n-able · n-centralAug 14, 2025

  • CVE-2025-20265
    45Plan

    Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    cisco · secure firewall management centerAug 14, 2025

  • CVE-2025-8971
    22Monitor

    itsourcecode Online Tour and Travel Management System travellers.php sql injection

    MediumCVSS 5.5Proof of conceptEPSS 0%

    mayurik · online tour \& travel management systemAug 14, 2025

  • CVE-2025-5844
    25Monitor

    Radius Blocks <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via subHeadingTagName Parameter

    MediumCVSS 6.4Proof of conceptEPSS 0%

    techlabpro1 · radius blocks – wordpress gutenberg blocksAug 15, 2025

  • CVE-2025-8091
    17Monitor

    EventON Lite <= 2.4.7 - Authenticated (Contributor+) Information Disclosure

    MediumCVSS 4.3Proof of conceptEPSS 0%

    ashanjay · eventon – events calendarAug 15, 2025

  • CVE-2025-54466
    45Plan

    Apache OFBiz: RCE Vulnerability in scrum plugin

    CriticalCVSS 9.8No exploitEPSS 19%

    apache · ofbizAug 15, 2025

  • CVE-2025-7441
    60This week

    StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8WeaponizedEPSS 50%

    storychief · storychiefAug 16, 2025

  • CVE-2025-38501
    31Monitor

    ksmbd: limit repeated connections from clients with the same IP

    HighCVSS 7.5Proof of conceptEPSS 2%

    linux · linux kernelAug 16, 2025