# CVEs published 2025-07-01

89 CVEs were published on July 1, 2025: 16 critical, 22 high. Days are UTC.

- [CVE-2025-36630](https://cve.now/CVE-2025-36630.md): Local Privilege Escalation (CVSS 8.4, Tenable Nessus)
- [CVE-2025-49741](https://cve.now/CVE-2025-49741.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 7.4, Microsoft Edge)
- [CVE-2025-46259](https://cve.now/CVE-2025-46259.md): WordPress The Plus Addons for Elementor - Pro Plugin \< 6.3.7 - Broken Access Control vulnerability (CVSS 5.4, POSIMYTH Innovation The Plus Addons for Elementor Pro)
- [CVE-2025-6600](https://cve.now/CVE-2025-6600.md): GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Search API (CVSS 6.3, GitHub Enterprise Server)
- [CVE-2025-48379](https://cve.now/CVE-2025-48379.md): Pillow Vulnerable to Write Buffer Overflow on BCn encoding (CVSS 7.1, python-pillow Pillow · pillow)
- [CVE-2025-27153](https://cve.now/CVE-2025-27153.md): Escalade GLPI Plugin Vulnerable to Improper Access Control (CVSS 6.5, pluginsGLPI escalade)
- [CVE-2025-53104](https://cve.now/CVE-2025-53104.md): gluestack-ui Command Injection Vulnerability via discussion-to-slack GitHub Action Workflow (CVSS 9.1, gluestack-ui)
- [CVE-2025-53103](https://cve.now/CVE-2025-53103.md): JUnit OpenTestReportGeneratingListener can leak Git credentials (CVSS 5.8, junit-team junit-framework · org.junit.platform:junit-platf…)
- [CVE-2025-34081](https://cve.now/CVE-2025-34081.md): CONPROSYS HMI System (CHS) \< 3.7.7 Exposed PHP Debug Info (CVSS 6.9, Contec Co. CONPROSYS HMI System)
- [CVE-2025-53107](https://cve.now/CVE-2025-53107.md): @cyanheads/git-mcp-server vulnerable to command injection in several tools (CVSS 7.5, cyanheads git-mcp-server · @cyanheads/git-mcp-server)
- [CVE-2025-34080](https://cve.now/CVE-2025-34080.md): CONPROSYS HMI System (CHS) \< 3.7.7 Reflected Cross-Site Scripting (CVSS 5.1, Contec Co. CONPROSYS HMI System)
- [CVE-2025-53100](https://cve.now/CVE-2025-53100.md): RestDB's Codehooks.io MCP Server Vulnerable to Command Injection (CVSS 8.6, RestDB codehooks-mcp-server)
- [CVE-2025-37099](https://cve.now/CVE-2025-37099.md): A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. (CVSS 9.8, Hewlett Packard Enterprise Insight Remote Support)
- [CVE-2025-6297](https://cve.now/CVE-2025-6297.md): dpkg-deb: Fix cleanup for control member with restricted directories (CVSS 8.2, Debian dpkg)
- [CVE-2025-6963](https://cve.now/CVE-2025-6963.md): Campcodes Employee Management System myprofile.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-6962](https://cve.now/CVE-2025-6962.md): Campcodes Employee Management System myprofileup.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-6961](https://cve.now/CVE-2025-6961.md): Campcodes Employee Management System mark.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-6960](https://cve.now/CVE-2025-6960.md): Campcodes Employee Management System empproject.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-6959](https://cve.now/CVE-2025-6959.md): Campcodes Employee Management System eloginwel.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-53099](https://cve.now/CVE-2025-53099.md): Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation (CVSS 5.5, getsentry sentry)
- [CVE-2025-34064](https://cve.now/CVE-2025-34064.md): OneLogin AD Connector Log S3 Bucket Hijack Leading to Cross-Tenant Data Leakage (CVSS 9.0, One Identity OneLogin Active Directory Connector)
- [CVE-2025-34063](https://cve.now/CVE-2025-34063.md): OneLogin AD Connector JWT Authentication Bypass via Exposed Signing Key (CVSS 10.0, One Identity OneLogin Active Directory Connector)
- [CVE-2025-34062](https://cve.now/CVE-2025-34062.md): OneLogin AD Connector API Credential and Signing Key Exposure (CVSS 5.7, One Identity OneLogin Active Directory Connector)
- [CVE-2025-34060](https://cve.now/CVE-2025-34060.md): Monero Forum Remote Code Execution via Arbitrary File Read and Cookie Forgery (CVSS 10.0, Monero Project Forum)
- [CVE-2025-34059](https://cve.now/CVE-2025-34059.md): Dahua Smart Cloud Gateway Registration Management Platform SQL Injection (CVSS 8.7, Zhejiang Dahua Technology Co. Smart Cloud Gateway Registrat…)
- [CVE-2025-34058](https://cve.now/CVE-2025-34058.md): Hikvision Streaming Media Management Server Default Credentials and Authenticated Arbitrary File Read (CVSS 8.7, Hangzhou Hikvision System Technology Streaming Media Manage…)
- [CVE-2025-34066](https://cve.now/CVE-2025-34066.md): AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure (CVSS 8.3, AVTECH IP cameras · AVTECH DVR devices +1)
- [CVE-2025-34065](https://cve.now/CVE-2025-34065.md): AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via /nobody URL Path (CVSS 6.9, AVTECH IP camera, DVR, and NVR Devices)
- [CVE-2025-34056](https://cve.now/CVE-2025-34056.md): AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution (CVSS 9.4, AVTECH IP camera, DVR, and NVR Devices)
- [CVE-2025-34055](https://cve.now/CVE-2025-34055.md): AVTECH IP camera, DVR, and NVR Devices Authenticated Root Command Execution (CVSS 9.4, AVTECH IP camera, DVR, and NVR Devices)
- [CVE-2025-34054](https://cve.now/CVE-2025-34054.md): AVTECH IP camera, DVR, and NVR Devices Unauthenticated Command Injection (CVSS 10.0, AVTECH IP camera, DVR, and NVR Devices)
- [CVE-2025-34053](https://cve.now/CVE-2025-34053.md): AVTECH IP camera, DVR, and NVR Devices Authentication Bypass via .cab Path Manipulation (CVSS 6.9, AVTECH IP camera, DVR, and NVR devices)
- [CVE-2025-34051](https://cve.now/CVE-2025-34051.md): AVTECH DVR Devices Server-Side Request Forgery (CVSS 6.9, AVTECH DVR devices)
- [CVE-2025-34050](https://cve.now/CVE-2025-34050.md): AVTECH IP Camera, DVR, and NVR Devices Cross-Site Request Forgery (CVSS 5.1, AVTECH IP cameras · AVTECH DVR devices +1)
- [CVE-2025-37098](https://cve.now/CVE-2025-37098.md): A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646. (CVSS 7.5, Hewlett Packard Enterprise Insight Remote Support)
- [CVE-2025-6958](https://cve.now/CVE-2025-6958.md): Campcodes Employee Management System edit.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-6957](https://cve.now/CVE-2025-6957.md): Campcodes Employee Management System eprocess.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-37097](https://cve.now/CVE-2025-37097.md): A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service (CVSS 7.5, Hewlett Packard Enterprise Insight Remote Support)
- [CVE-2025-6956](https://cve.now/CVE-2025-6956.md): Campcodes Employee Management System changepassemp.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-6955](https://cve.now/CVE-2025-6955.md): Campcodes Employee Management System aprocess.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-6954](https://cve.now/CVE-2025-6954.md): Campcodes Employee Management System applyleave.php sql injection (CVSS 6.9, Campcodes Employee Management System)
- [CVE-2025-6953](https://cve.now/CVE-2025-6953.md): TOTOLINK A3002RU HTTP POST Request formParentControl buffer overflow (CVSS 8.7, TOTOLINK A3002RU)
- [CVE-2025-49029](https://cve.now/CVE-2025-49029.md): WordPress Custom Login And Signup Widget plugin \<= 1.0 - Arbitrary Code Execution vulnerability (CVSS 9.1, bitto.kazi Custom Login And Signup Widget)
- [CVE-2025-6920](https://cve.now/CVE-2025-6920.md): Ai-inference-server: authentication bypass via unprotected inference endpoint in api (CVSS 5.3, Red Hat AI Inference Server)
- [CVE-2025-36582](https://cve.now/CVE-2025-36582.md): Dell NetWorker, versions 19.12.0.1 and prior, contains a Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') vulne (CVSS 4.8, Dell NetWorker)
- [CVE-2025-6952](https://cve.now/CVE-2025-6952.md): Open5GS AMF Service amf-sm.c amf\_state\_operational assertion (CVSS 4.8, Open5GS)
- [CVE-2025-6951](https://cve.now/CVE-2025-6951.md): SAFECAM X300 FTP Service default credentials (CVSS 5.3, SAFECAM X300)
- [CVE-2025-49483](https://cve.now/CVE-2025-49483.md): Resource leaks in tr069 (CVSS 5.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-49482](https://cve.now/CVE-2025-49482.md): Resource leaks in tr069 (CVSS 5.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-5314](https://cve.now/CVE-2025-5314.md): Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer \<= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source' (CVSS 6.1, dearhive Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF emb…)
- [CVE-2025-49481](https://cve.now/CVE-2025-49481.md): Resource leaks in router (CVSS 5.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-49480](https://cve.now/CVE-2025-49480.md): Out-of-bounds access in lte-telephony (CVSS 7.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-49488](https://cve.now/CVE-2025-49488.md): Resource leaks in router (CVSS 5.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-49492](https://cve.now/CVE-2025-49492.md): Out-of-bounds write in lte-telephony (CVSS 7.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-6224](https://cve.now/CVE-2025-6224.md): Key leakage in juju/utils certificates (CVSS 6.5, Canonical Juju utils · github.com/juju/utils/v4/cert +4)
- [CVE-2025-49491](https://cve.now/CVE-2025-49491.md): Resource leaks in traffic\_stat (CVSS 5.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-49490](https://cve.now/CVE-2025-49490.md): Resource leaks in router (CVSS 5.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-49489](https://cve.now/CVE-2025-49489.md): Resource leaks in cm (CVSS 5.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-6756](https://cve.now/CVE-2025-6756.md): Ultra Addons for Contact Form 7 \<= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7\_CUSTOM\_FIELDS Shortcode (CVSS 6.4, themefic Ultra Addons for Contact Form)
- [CVE-2025-5072](https://cve.now/CVE-2025-5072.md): Resource leaks in cm (CVSS 5.4, ASR Falcon\_Linux、Kestrel、Lapwing\_Linux)
- [CVE-2025-41648](https://cve.now/CVE-2025-41648.md): Pilz: Authentication Bypass in IndustrialPI Webstatus (CVSS 9.8, Pilz IndustrialPI 4 with IndustrialPI webstatus)
- [CVE-2025-41656](https://cve.now/CVE-2025-41656.md): Pilz: Missing Authentication in Node-RED integration (CVSS 10.0, Pilz IndustrialPI 4 with Firmware Bullseye)
- [CVE-2025-6934](https://cve.now/CVE-2025-6934.md): Opal Estate Pro \<= 1.7.5 - Unauthenticated Privilege Escalation via 'on\_regiser\_user' (CVSS 9.8, wpopal Opal Estate Pro – Property Management and Submission)
- [CVE-2025-6081](https://cve.now/CVE-2025-6081.md): Pass-back attack in Konica Minolta bizhub 227 multifunctional printers (CVSS 6.8, Konica Minolta bizhub 227 Multifunction printers)
- [CVE-2025-5967](https://cve.now/CVE-2025-5967.md): A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows a malicious user to inject arbitrary HTML into the ENS HX Malware Scan N (CVSS 5.3, Trellix Endpoint Security HX)
- [CVE-2025-6940](https://cve.now/CVE-2025-6940.md): TOTOLINK A702R HTTP POST Request formParentControl buffer overflow (CVSS 8.7, TOTOLINK A702R)
- [CVE-2024-49364](https://cve.now/CVE-2024-49364.md): tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment (CVSS 8.1, bitcoinjs tiny-secp256k1 · tiny-secp256k1)
- [CVE-2024-49365](https://cve.now/CVE-2024-49365.md): tiny-secp256k1 allows for verify() bypass when running in bundled environment (CVSS 8.1, bitcoinjs tiny-secp256k1 · tiny-secp256k1)
- [CVE-2025-6939](https://cve.now/CVE-2025-6939.md): TOTOLINK A3002RU HTTP POST Request formWlSiteSurvey buffer overflow (CVSS 8.7, TOTOLINK A3002RU)
- [CVE-2024-46993](https://cve.now/CVE-2024-46993.md): Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath (CVSS 4.4, electron)
- [CVE-2024-46992](https://cve.now/CVE-2024-46992.md): Electron ASAR Integrity bypass by just modifying the content (CVSS 7.8, electron)
- [CVE-2025-53095](https://cve.now/CVE-2025-53095.md): Sunshine application-wide CSRF in the UI leads to command injection as Administrator (CVSS 9.7, LizardByte Sunshine)
- [CVE-2025-53096](https://cve.now/CVE-2025-53096.md): Sunshine clickjacking in the UI leads to unauthorized actions being performed (CVSS 5.4, LizardByte Sunshine)
- [CVE-2025-6938](https://cve.now/CVE-2025-6938.md): code-projects Simple Pizza Ordering System editcus.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-53003](https://cve.now/CVE-2025-53003.md): Janssen Config API returns results without scope verification (CVSS 8.2, JanssenProject jans · io.jans:jans-config-api-server)
- [CVE-2025-2141](https://cve.now/CVE-2025-2141.md): IBM System Storage Virtualization Engine TS7700 cross-site scripting (CVSS 6.1, IBM System Storage Virtualization Engine TS7700)
- [CVE-2025-36056](https://cve.now/CVE-2025-36056.md): IBM System Storage Virtualization Engine TS7700 cross-site scripting (CVSS 5.4, IBM System Storage Virtualization Engine TS7700)
- [CVE-2025-53005](https://cve.now/CVE-2025-53005.md): Dataease PostgreSQL Data Source JDBC Connection Parameters Bypass Vulnerability (CVSS 8.9, dataease)
- [CVE-2025-6937](https://cve.now/CVE-2025-6937.md): code-projects Simple Pizza Ordering System large.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-6936](https://cve.now/CVE-2025-6936.md): code-projects Simple Pizza Ordering System addpro.php sql injection (CVSS 6.9, code-projects Simple Pizza Ordering System)
- [CVE-2025-45006](https://cve.now/CVE-2025-45006.md): Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec constraints, enabling (CVSS 9.1)
- [CVE-2025-45081](https://cve.now/CVE-2025-45081.md): Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data. (CVSS 8.8)
- [CVE-2025-45083](https://cve.now/CVE-2025-45083.md): Incorrect access control in Ullu (Android version v2.9.929 and IOS version v2.8.0) allows attackers to bypass parental pin feature via unspe (CVSS 6.1)
- [CVE-2025-45872](https://cve.now/CVE-2025-45872.md): zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter. (CVSS 9.8)
- [CVE-2025-50404](https://cve.now/CVE-2025-50404.md): Intelbras RX1500 Router v2.2.17 and before is vulnerable to Integer Overflow. (CVSS 5.3)
- [CVE-2025-50405](https://cve.now/CVE-2025-50405.md): Intelbras RX1500 Router v2.2.17 and before is vulnerable to Incorrect Access Control in the FirmwareUpload function and GetFirmwareValidatio (CVSS 6.5)
- [CVE-2025-50641](https://cve.now/CVE-2025-50641.md): Tenda AC6 15.03.05.16\_multi is vulnerable to Buffer Overflow in the addWifiMacFilter function via the parameter deviceId. (CVSS 6.5)
- [CVE-2025-52101](https://cve.now/CVE-2025-52101.md): linjiashop \<=0.9 is vulnerable to Incorrect Access Control. (CVSS 9.8)
- [CVE-2025-52294](https://cve.now/CVE-2025-52294.md): Insufficient validation of the screen lock mechanism in Trust Wallet v8.45 allows physically proximate attackers to bypass the lock screen a (CVSS 5.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.