# CVEs published 2025-07-02

84 CVEs were published on July 2, 2025: 13 critical, 25 high. Days are UTC.

- [CVE-2025-52842](https://cve.now/CVE-2025-52842.md): Laundry 2.3.0 - Account Takeover via Reflected XSS (CVSS 5.1, Laundry)
- [CVE-2025-43025](https://cve.now/CVE-2025-43025.md): HP Universal Print Driver – Potential Denial of Service (CVSS 4.8, HP Universal Print Driver)
- [CVE-2025-52559](https://cve.now/CVE-2025-52559.md): Zulip XSS in digest preview URL (CVSS 6.8, zulip)
- [CVE-2025-34079](https://cve.now/CVE-2025-34079.md): NSClient++ Authenticated Remote Code Execution via ExternalScripts API (CVSS 7.5, NSClient++)
- [CVE-2025-34078](https://cve.now/CVE-2025-34078.md): NSClient++ 0.5.2.35 Local Privilege Escalation via ExternalScripts and Web Interface (CVSS 7.3, NSClient++)
- [CVE-2025-34076](https://cve.now/CVE-2025-34076.md): Microweber CMS Authenticated Local File Inclusion via Backup API (CVSS 6.1, Microweber CMS · microweber/microweber)
- [CVE-2025-34074](https://cve.now/CVE-2025-34074.md): Lucee Admin Interface Authenticated Remote Code Execution via Scheduled Job File Write (CVSS 9.4, Lucee Association Switzerland Lucee)
- [CVE-2025-49713](https://cve.now/CVE-2025-49713.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2025-52841](https://cve.now/CVE-2025-52841.md): Laundry 2.3.0 - Account Takeover via CSRF (CVSS 8.5, Laundry)
- [CVE-2025-20309](https://cve.now/CVE-2025-20309.md): Cisco Unified Communications Manager Static SSH Credentials Vulnerability (CVSS 10.0, Cisco Unified Communications Manager)
- [CVE-2025-20307](https://cve.now/CVE-2025-20307.md): Cisco BroadWorks Application Delivery Platform Cross-Site Scripting Vulnerability (CVSS 4.8, Cisco BroadWorks)
- [CVE-2025-20310](https://cve.now/CVE-2025-20310.md): Cisco Enterprise Chat and Email Stored Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Enterprise Chat and Email)
- [CVE-2025-20308](https://cve.now/CVE-2025-20308.md): Cisco Spaces Connector Privilege Escalation Vulnerability (CVSS 6.0, Cisco DNA Spaces Connector)
- [CVE-2025-53359](https://cve.now/CVE-2025-53359.md): ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactions (CVSS 6.9, rust-ethereum ethereum · ethereum)
- [CVE-2025-6942](https://cve.now/CVE-2025-6942.md): The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial author (CVSS 3.8, Delinea Secret Server)
- [CVE-2025-52886](https://cve.now/CVE-2025-52886.md): Poppler Use After Free Vulnerability (CVSS 5.5, poppler)
- [CVE-2025-6943](https://cve.now/CVE-2025-6943.md): Secret Server version 11.7 and earlier is vulnerable to a SQL report creation vulnerability that allows an administrator to gain access to r (CVSS 3.8, Delinea Secret Server)
- [CVE-2025-53358](https://cve.now/CVE-2025-53358.md): kotaemon Vulnerable to Path Traversal via Link Upload (CVSS 6.5, Cinnamon kotaemon)
- [CVE-2025-52891](https://cve.now/CVE-2025-52891.md): ModSecurity empty XML tag causes segmentation fault (CVSS 6.5, owasp-modsecurity ModSecurity)
- [CVE-2025-53108](https://cve.now/CVE-2025-53108.md): HomeBox Missing User Authorization (CVSS 5.3, sysadminsmedia homebox)
- [CVE-2025-38093](https://cve.now/CVE-2025-38093.md): arm64: dts: qcom: x1e80100: Add GPU cooling (no CVSS, Linux)
- [CVE-2025-38092](https://cve.now/CVE-2025-38092.md): ksmbd: use list\_first\_entry\_or\_null for opinfo\_get\_list() (CVSS 8.8, Linux)
- [CVE-2025-38091](https://cve.now/CVE-2025-38091.md): drm/amd/display: check stream id dml21 wrapper to get plane\_id (no CVSS, Linux)
- [CVE-2025-53492](https://cve.now/CVE-2025-53492.md): Stored XSS in MintyDocs (CVSS 3.7, Wikimedia Foundation Mediawiki - MintyDocs Extension)
- [CVE-2025-6725](https://cve.now/CVE-2025-6725.md): Cross-Site Scripting (XSS) in PdfViewer (CVSS 5.4, Progress Software Kendo UI for jQuery · Progress Softwar… +4)
- [CVE-2025-53493](https://cve.now/CVE-2025-53493.md): Stored XSS in MintyDocs (CVSS 6.5, Wikimedia Foundation Mediawiki - MintyDocs Extension)
- [CVE-2025-53109](https://cve.now/CVE-2025-53109.md): Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling (CVSS 7.3, modelcontextprotocol servers · @modelcontextprotocol/server…)
- [CVE-2025-53110](https://cve.now/CVE-2025-53110.md): Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefix (CVSS 7.3, modelcontextprotocol servers · @modelcontextprotocol/server…)
- [CVE-2025-53494](https://cve.now/CVE-2025-53494.md): Stored XSS in TwoColConflict (CVSS 6.5, Wikimedia Foundation Mediawiki - TwoColConflict Extension)
- [CVE-2025-53006](https://cve.now/CVE-2025-53006.md): Dataease PostgreSQL & Redshift Data Source JDBC Connection Parameters Bypass Vulnerability (CVSS 8.9, dataease)
- [CVE-2025-49588](https://cve.now/CVE-2025-49588.md): Linkwarden Local File Inclusion Vulnerability (CVSS 8.7, linkwarden)
- [CVE-2025-34073](https://cve.now/CVE-2025-34073.md): stamparm/maltrail \<=0.54 Remote Command Execution (CVSS 10.0, Stamparm Maltrail)
- [CVE-2025-34072](https://cve.now/CVE-2025-34072.md): Anthropic Slack MCP Server Data Exfiltration via Link Unfurling (CVSS 9.3, Anthropic Slack MCP Server)
- [CVE-2025-34071](https://cve.now/CVE-2025-34071.md): GFI Kerio Control Unsigned System Image Upload Root Code Execution (CVSS 9.4, GFI Software Kerio Control)
- [CVE-2025-34070](https://cve.now/CVE-2025-34070.md): GFI Kerio Control GFIAgent Missing Authentication on Administrative Interfaces (CVSS 10.0, GFI Software Kerio Control)
- [CVE-2025-34069](https://cve.now/CVE-2025-34069.md): GFI Kerio Control GFIAgent Authentication Bypass via Proxy Forwarding (CVSS 9.5, GFI Software Kerio Control)
- [CVE-2025-34067](https://cve.now/CVE-2025-34067.md): Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson (CVSS 10.0, Hikvision Integrated Security Management Platform)
- [CVE-2025-34057](https://cve.now/CVE-2025-34057.md): Ruijie NBR Router Administrative Credential Disclosure (CVSS 8.7, Ruijie NBR Router)
- [CVE-2025-27026](https://cve.now/CVE-2025-27026.md): Improper Access Control Granularity impacting Infinera G42 (CVSS 4.9, Infinera G42)
- [CVE-2025-53106](https://cve.now/CVE-2025-53106.md): Graylog vulnerable to privilege escalation through API tokens (CVSS 8.8, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2024-35164](https://cve.now/CVE-2024-35164.md): Apache Guacamole: Improper input validation of console codes (CVSS 6.8, Apache Software Foundation Apache Guacamole)
- [CVE-2025-46647](https://cve.now/CVE-2025-46647.md): Apache APISIX: improper validation of issuer from introspection discovery url in plugin openid-connect (CVSS 5.3, Apache Software Foundation Apache APISIX)
- [CVE-2025-39362](https://cve.now/CVE-2025-39362.md): WordPress Mollie Payments for WooCommerce plugin \<= 8.0.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5, Mollie Payments for WooCommerce)
- [CVE-2025-27025](https://cve.now/CVE-2025-27025.md): Improper File Access in Infinera G42 (CVSS 8.8, Infinera G42)
- [CVE-2025-27024](https://cve.now/CVE-2025-27024.md): Improper File Access in Infinera G42 (CVSS 6.5, Infinera G42)
- [CVE-2025-2330](https://cve.now/CVE-2025-2330.md): All-in-One Addons for Elementor – WidgetKit \<= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget (CVSS 6.4, shamsbd71 All-in-One Addons for Elementor – WidgetKit)
- [CVE-2025-4946](https://cve.now/CVE-2025-4946.md): Vikinger \<= 1.9.32 - Authenticated (Subscriber+) Arbitrary File Deletion via vikinger\_delete\_activity\_media\_ajax Function (CVSS 8.1, Odin\_Design Vikinger)
- [CVE-2025-27023](https://cve.now/CVE-2025-27023.md): Improper Input Validation in Infinera G42 (CVSS 6.5, Infinera G42)
- [CVE-2025-27022](https://cve.now/CVE-2025-27022.md): Path Traversal Vulnerability in Infinera G42 (CVSS 7.5, Infinera G42)
- [CVE-2025-27021](https://cve.now/CVE-2025-27021.md): Operating System Misconfiguration in Infinera G42 (CVSS 7.0, Infinera G42)
- [CVE-2025-24335](https://cve.now/CVE-2025-24335.md): SOAP message input validation fault could in theory cause OAM service resource exhaustion (CVSS 2.0, Nokia Single RAN)
- [CVE-2025-24334](https://cve.now/CVE-2025-24334.md): The Nokia Single RAN baseband reveals its software version through the MNO internal RAN management network (CVSS 3.3, Nokia Single RAN)
- [CVE-2025-24333](https://cve.now/CVE-2025-24333.md): Administrative user shell input validation fault (CVSS 6.4, Nokia Single RAN)
- [CVE-2025-24332](https://cve.now/CVE-2025-24332.md): Authenticated admin user can connect baseband internally from one board to another without needing to re-authentication (CVSS 7.1, Nokia Single RAN AirScale)
- [CVE-2025-24331](https://cve.now/CVE-2025-24331.md): Nokia Single RAN baseband OAM service extensive capabilities (CVSS 6.4, Nokia Single RAN)
- [CVE-2025-24330](https://cve.now/CVE-2025-24330.md): OAM service path traversal issue caused by a crafted SOAP message PlanId field within the RAN management network (CVSS 6.4, Nokia Single RAN)
- [CVE-2025-24329](https://cve.now/CVE-2025-24329.md): OAM service path traversal issue caused by a crafted SOAP message archive field within the RAN management network (CVSS 6.4, Nokia Single RAN)
- [CVE-2025-24328](https://cve.now/CVE-2025-24328.md): OAM service stack overflow caused by crafted SOAP message within the MNO internal RAN management network (CVSS 4.2, Nokia Single RAN)
- [CVE-2024-13786](https://cve.now/CVE-2024-13786.md): Education Center | LMS & Online Courses WordPress Theme \<= 3.6.10 - PHP Object Injection (CVSS 9.8, ThemeREX Education Center | LMS & Online Courses WordPress…)
- [CVE-2025-6017](https://cve.now/CVE-2025-6017.md): Rhacm: users with clusterreader role can see credentials from managed-clusters (CVSS 5.5, ocm · Red Hat Advanced Cluster Management for Kubernetes… +1)
- [CVE-2024-13451](https://cve.now/CVE-2024-13451.md): Contact Form by Bit Form \<= 2.17.5 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, bitpressadmin Bit Form – Custom Contact Form, Multi Step, C…)
- [CVE-2025-6464](https://cve.now/CVE-2025-6464.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion (CVSS 7.5, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2025-52463](https://cve.now/CVE-2025-52463.md): Cross-site request forgery vulnerability exists in Active! mail 6 BuildInfo: 6.60.06008562 and earlier. (CVSS 3.1, QUALITIA CO. Active! mail)
- [CVE-2025-52462](https://cve.now/CVE-2025-52462.md): Cross-site scripting vulnerability exists in Active! mail 6 BuildInfo: 6.30.01004145 to 6.60.06008562. (CVSS 6.1, QUALITIA CO. Active! mail)
- [CVE-2025-6463](https://cve.now/CVE-2025-6463.md): Forminator Forms – Contact Form, Payment Form & Custom Form Builder \<= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion (CVSS 8.8, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2024-11405](https://cve.now/CVE-2024-11405.md): WP Front-end login and register \<= 2.1.0 - Reflected Cross-Site Scripting (CVSS 6.1, hellomohsinkhan WP Front-end login and register)
- [CVE-2025-5339](https://cve.now/CVE-2025-5339.md): Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \<= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa\_pro\_id' (CVSS 7.5, scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…)
- [CVE-2025-5014](https://cve.now/CVE-2025-5014.md): Home Villas | Real Estate WordPress Theme \<= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion (CVSS 8.8, Chimp Group Home Villas | Real Estate WordPress Theme)
- [CVE-2025-6437](https://cve.now/CVE-2025-6437.md): Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \<= 4.89 - Unauthenticated SQL Injection via oid (CVSS 7.5, scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…)
- [CVE-2025-5817](https://cve.now/CVE-2025-5817.md): Amazon Products to WooCommerce \<= 1.2.7 - Unauthenticated Server-Side Request Forgery (CVSS 7.2, suhailahmad64 Amazon Products to WooCommerce)
- [CVE-2025-4654](https://cve.now/CVE-2025-4654.md): Soumettre.fr \<= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion (CVSS 3.7, Soumettre.fr)
- [CVE-2025-6686](https://cve.now/CVE-2025-6686.md): Magic Buttons for Elementor \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode (CVSS 6.4, rexdot Magic Buttons for Elementor)
- [CVE-2025-5746](https://cve.now/CVE-2025-5746.md): Drag and Drop Multiple File Upload (Pro) - WooCommerce \<= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload (CVSS 9.8, CodeDropz Drag and Drop Multiple File Upload (Pro) - WooCom…)
- [CVE-2025-4380](https://cve.now/CVE-2025-4380.md): Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \<= 4.89 - Unauthenticated Local File Inclusion (CVSS 8.1, scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…)
- [CVE-2025-6687](https://cve.now/CVE-2025-6687.md): Magic Buttons for Elementor \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode (CVSS 6.4, rexdot Magic Buttons for Elementor)
- [CVE-2025-6459](https://cve.now/CVE-2025-6459.md): Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \<= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate (CVSS 8.8, scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…)
- [CVE-2025-4381](https://cve.now/CVE-2025-4381.md): Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \<= 4.89 - Unauthenticated SQL Injection (CVSS 7.5, scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…)
- [CVE-2025-4689](https://cve.now/CVE-2025-4689.md): Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager \<= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution (CVSS 9.8, scripteo Ads Pro Plugin - Multi-Purpose WordPress Advertisi…)
- [CVE-2025-5692](https://cve.now/CVE-2025-5692.md): Lead Form Data Collection to CRM \<= 3.1 - Missing Authorization to Authenticated (Subscriber+) Many Actions (CVSS 6.3, smackcoders Lead Form Data Collection to CRM)
- [CVE-2025-45029](https://cve.now/CVE-2025-45029.md): WINSTAR WN572HP3 v230525 was discovered to contain a heap overflow via the CONTENT\_LENGTH variable at /cgi-bin/upload.cgi. (CVSS 6.5)
- [CVE-2025-45424](https://cve.now/CVE-2025-45424.md): Incorrect access control in Xinference before v1.4.0 allows attackers to access the Web GUI without authentication. (CVSS 5.3)
- [CVE-2025-45813](https://cve.now/CVE-2025-45813.md): ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials. (CVSS 9.8)
- [CVE-2025-45814](https://cve.now/CVE-2025-45814.md): Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attac (CVSS 9.8)
- [CVE-2025-52925](https://cve.now/CVE-2025-52925.md): In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812. (CVSS 5.0, OneLogin Active Directory Connector)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.