Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: August 2025

332 records · 12 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 4 of 4

  • CVE-2025-50428
    39Monitor

    In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    raspap · raspap-webguiAug 27, 2025

  • CVE-2025-50979
    37Monitor

    NodeBB v4.3.0 is vulnerable to SQL injection in its search-categories API endpoint (/api/v3/search/categories).

    HighCVSS 8.6No exploitEPSS 10%

    nodebb · nodebbAug 27, 2025

  • CVE-2018-25115
    43Plan

    D-Link DIR-110/412/600/615/645/815 RCE via service.cgi

    CriticalCVSS 10.0No exploitEPSS 10%

    dlink · dir-110 firmwareAug 27, 2025

  • CVE-2024-13979
    38Monitor

    St. Joe ERP System SingleRowQueryConverter SQL Injection

    CriticalCVSS 9.3Proof of conceptEPSS 3%

    st. joe erp system project · st. joe erp systemAug 27, 2025

  • CVE-2024-13985
    45Plan

    Dahua EIMS capture_handle.action RCE

    CriticalCVSS 10.0Proof of conceptEPSS 15%

    zhejiang dahua technology co., ltd. · eimsAug 27, 2025

  • CVE-2025-9345
    19Monitor

    File Manager, Code Editor, and Backup by Managefy <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download

    MediumCVSS 4.9Proof of conceptEPSS 0%

    softdiscover · file manager, code editor, and backup by managefyAug 28, 2025

  • CVE-2025-7955
    39Monitor

    RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    pbmacintyre · ringcentral communications plugin – freeAug 28, 2025

  • CVE-2025-51643
    9Monitor

    Meitrack T366G-L GPS Tracker devices contain an SPI flash chip (Winbond 25Q64JVSIQ) that is accessible without authentication or tamper prot

    LowCVSS 2.4Proof of conceptEPSS 0%

    meitrack · t366l-g firmwareAug 28, 2025

  • CVE-2025-57819
    99Now

    FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE

    CriticalCVSS 10.0KEVWeaponizedEPSS 95%

    sangoma · freepbxAug 28, 2025

  • CVE-2025-49388
    41Plan

    WordPress Miraculous Core Plugin Plugin <= 2.0.7 - Privilege Escalation Vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    kamleshyadav · miraculous core pluginAug 28, 2025

  • CVE-2025-8067
    34Monitor

    Udisks: out-of-bounds read in udisks daemon

    HighCVSS 8.5Proof of conceptEPSS 0%

    storaged-project · udisksAug 28, 2025

  • CVE-2025-39247
    34Monitor

    There is an Access Control Vulnerability in some HikCentral Professional versions.

    HighCVSS 8.6Proof of conceptEPSS 0%

    hikvision · hikcentral professionalAug 29, 2025

  • CVE-2025-55177
    55Plan

    Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25

    MediumCVSS 5.4KEVWeaponizedEPSS 13%

    whatsapp · whatsappAug 29, 2025

  • CVE-2025-55579
    21Monitor

    SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    solidinvoice · solidinvoiceAug 29, 2025

  • CVE-2025-55580
    21Monitor

    SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    solidinvoice · solidinvoiceAug 29, 2025

  • CVE-2025-55763
    30Monitor

    Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code execution via a cra

    HighCVSS 7.5Proof of conceptEPSS 1%

    civetweb project · civetwebAug 29, 2025

  • CVE-2025-9377
    76This week

    Authenticated RCE via Parental Control command injection

    HighCVSS 8.6KEVWeaponizedEPSS 41%

    tp-link · tl-wr841n firmwareAug 29, 2025

  • CVE-2025-57822
    33Monitor

    Next.js Improper Middleware Redirect Handling Leads to SSRF

    HighCVSS 8.2Proof of conceptEPSS 2%

    vercel · next.jsAug 29, 2025

  • CVE-2005-10004
    40Plan

    Cacti graph_view.php RCE via graph_start Parameter Injection

    HighCVSS 8.7WeaponizedEPSS 2%

    cacti · cactiAug 30, 2025

  • CVE-2008-20001
    60This week

    activePDF WebGrabber ActiveX Control Buffer Overflow

    HighCVSS 7.5WeaponizedEPSS 1%

    activepdf · webgrabberAug 30, 2025

  • CVE-2010-10016
    60This week

    BS.Player 2.57 Buffer Overflow via M3U Playlist Import

    CriticalCVSS 10.0WeaponizedEPSS 1%

    bs.player · bs.player free and pro editionsAug 30, 2025

  • CVE-2010-10017
    40Plan

    WM Downloader 3.1.2.2 Buffer Overflow via Malformed M3U File

    HighCVSS 8.4WeaponizedEPSS 0%

    wm downloader · wm downloaderAug 30, 2025

  • CVE-2011-10032
    60This week

    Sunway Forcecontrol SNMP NetDBServer.exe Opcode 0x57

    CriticalCVSS 9.3WeaponizedEPSS 1%

    sunway · forcecontrolAug 30, 2025

  • CVE-2012-10062
    40Plan

    XAMPP WebDAV PHP Upload Authentication Bypass RCE

    HighCVSS 8.7WeaponizedEPSS 1%

    apache friends · xamppAug 30, 2025

  • CVE-2009-20008
    60This week

    Green Dam 3.17 URL Processing Buffer Overflow

    HighCVSS 8.6WeaponizedEPSS 1%

    zhengzhou jinhui computer system engineering co. ltd. ; beijing dazheng human language technology academy · green dam youth escortAug 30, 2025

  • CVE-2009-20009
    60This week

    Belkin Bulldog Plus Web Service Buffer Overflow

    CriticalCVSS 9.3WeaponizedEPSS 1%

    belkin international, inc. · bulldog plus ups monitoring softwareAug 30, 2025

  • CVE-2009-20010
    60This week

    Dogfood CRM spell.php RCE

    CriticalCVSS 9.3WeaponizedEPSS 1%

    dogfood crm · dogfood crmAug 30, 2025

  • CVE-2009-20011
    60This week

    ContentKeeper Web Appliance < 125.10 RCE via mimencode

    CriticalCVSS 10.0WeaponizedEPSS 1%

    contentkeeper technologies · contentkeeper web applianceAug 30, 2025

  • CVE-2025-9728
    21Monitor

    givanz Vvveb login.tpl cross site scripting

    MediumCVSS 5.3Proof of conceptEPSS 0%

    vvveb · vvvebAug 31, 2025

  • CVE-2025-9744
    23Monitor

    Campcodes Online Loan Management System ajax.php sql injection

    MediumCVSS 5.5Proof of conceptEPSS 1%

    campcodes · online loan management systemAug 31, 2025

  • CVE-2025-9745
    12Monitor

    D-Link DI-500WF jhttpd version_upgrade.asp os command injection

    LowCVSS 2.0No exploitEPSS 12%

    dlink · di-500wf firmwareAug 31, 2025

  • CVE-2025-9752
    28Monitor

    D-Link DIR-852 SOAP Service soap.cgi soapcgi_main os command injection

    MediumCVSS 5.5No exploitEPSS 18%

    dlink · dir-852 firmwareAug 31, 2025