CVEs published July 7, 2025
175 CVEs were published on July 7, 2025: 22 critical, 40 high.
- Published
- 175
- Critical
- 22
- High
- 40
- Medium
- 104
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 66
Most affected products
- Huawei HarmonyOS
- 17
- Marvell QConvergeConsole
- 15
- SourceCodester Best Salon Management System
- 8
- LabRedesCefetRJ WeGIA
- 7
- Splunk Enterprise
- 6
- Campcodes Complaint Management System
- 5
- Campcodes Payroll Management System
- 5
- MongoDB Server
- 5
- Portabilis i-Educar
- 5
- BoyunCMS
- 4
Critical 22
- CVE-2025-53499Unauthorized Inspection of Protected Variables in AbuseFilterWikimedia Foundation Mediawiki - AbuseFilter Extension
- CVE-2025-53495Unauthorized Disclosure of IP Reputation in AbuseFilterWikimedia Foundation Mediawiki - AbuseFilter Extension
- CVE-2025-53529WeGIA allows SQL Injection in html/funcionario/profile_funcionario.php (id_funcionario parameter)LabRedesCefetRJ WeGIA
- CVE-2025-6811Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution VulnerabilityMescius ActiveReports.NET
- CVE-2025-6810Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution VulnerabilityMescius ActiveReports.NET
- CVE-2025-6802Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution VulnerabilityMarvell QConvergeConsole
- CVE-2025-6794Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution VulnerabilityMarvell QConvergeConsole
- CVE-2025-6793Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure VulnerabilityMarvell QConvergeConsole
- CVE-2025-3466Unsanitized Input in langgenius/difylanggenius/dify
- CVE-2025-4779Stored Cross-site Scripting (XSS) in lunary-ai/lunarylunary-ai/lunary
- CVE-2025-3626OS Command Injection via Config Upload in WebUIFrauscher FDS102
- CVE-2025-41672WAGO: Vulnerability in WAGO Device SphereWago Device Sphere
- CVE-2025-48501An OS command injection issue exists in Nimesa Backup and Recovery v2.3 and v2.4.Nimesa Backup and Recovery
- CVE-2024-25176LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c.
- CVE-2024-25178LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c.
- CVE-2025-43930Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the
- CVE-2025-43931flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a re
- CVE-2025-43932JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depe
- CVE-2025-43933fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends
- CVE-2025-45065employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint
- CVE-2025-45479Insufficient security mechanisms for created containers in educoder challenges v1.0 allow attackers to execute arbitrary code via injecting
- CVE-2025-47202In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580
High 40
- CVE-2025-53540CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Executionespressif arduino-esp32
- CVE-2025-53536Roo Code allows Potential Remote Code Execution via .vscode/settings.jsonRooCodeInc Roo-Code
- CVE-2025-53531WeGIA allows Uncontrolled Resource Consumption via the fid parameterLabRedesCefetRJ WeGIA
- CVE-2025-53530WeGIA allows Uncontrolled Resource Consumption via the errorstr parameterLabRedesCefetRJ WeGIA
- CVE-2025-53527WeGIA allows Time-Based Blind SQL Injection in the relatorio_geracao.php endpointLabRedesCefetRJ WeGIA
- CVE-2025-36014IBM Integration Bus for z/OS code injectionIBM Integration Bus
- CVE-2025-53373Natours has a 1 Click Account take over on reset password via Host Header injectionahmed-elgaml11 Natours
- CVE-2025-48367Redis DoS Vulnerability due to bad connection error handlingredis
- CVE-2025-32023Redis allows out of bounds writes in hyperloglog commands leading to RCEredis
- CVE-2025-6663GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityGStreamer
- CVE-2025-6806Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write VulnerabilityMarvell QConvergeConsole
- CVE-2025-6801Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write VulnerabilityMarvell QConvergeConsole
- CVE-2025-6800Marvell QConvergeConsole restoreESwitchConfig Directory Traversal Information Disclosure VulnerabilityMarvell QConvergeConsole
- CVE-2025-6799Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure VulnerabilityMarvell QConvergeConsole
- CVE-2025-6798Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion VulnerabilityMarvell QConvergeConsole
- CVE-2025-6797Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure VulnerabilityMarvell QConvergeConsole
- CVE-2025-6805Marvell QConvergeConsole deleteEventLogFile Directory Traversal Arbitrary File Deletion VulnerabilityMarvell QConvergeConsole
- CVE-2025-6796Marvell QConvergeConsole getAppFileBytes Directory Traversal Information Disclosure VulnerabilityMarvell QConvergeConsole
- CVE-2025-6804Marvell QConvergeConsole compressFirmwareDumpFiles Directory Traversal Information Disclosure VulnerabilityMarvell QConvergeConsole
- CVE-2025-6803Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure VulnerabilityMarvell QConvergeConsole
- CVE-2025-6714Incorrect Handling of incomplete data may prevent mongoS from Accepting New ConnectionsMongoDB Server
- CVE-2025-6713MongoDB Server may be susceptible to privilege escalation due to $mergeCursors stageMongoDB Server
- CVE-2025-5987Libssh: invalid return code for chacha20 poly1305 with openssl backendlibssh · Red Hat Enterprise Linux +1
- CVE-2025-6209Arbitrary File Read through Path Traversal in run-llama/llama_indexrun-llama/llama_index · llama-index-core +1
- CVE-2025-3467XSS Vulnerability in langgenius/difylanggenius/dify
- CVE-2025-6386Timing Attack Vulnerability in parisneo/lollmsparisneo/lollms · lollms
- CVE-2025-3046Path Traversal via Symbolic Links in run-llama/llama_indexrun-llama/llama_index · llama-index +1
- CVE-2025-3225XML Entity Expansion vulnerability in run-llama/llama_indexrun-llama/llama_index · llama-index-readers-papers +1
- CVE-2024-43334WordPress Zilom theme < 1.4.5 - Cross Site Scripting (XSS) vulnerabilitygavias Zilom
- CVE-2025-3920Hard-coded Password in SUR-FBD CMMSSUR-FBD CMMS
- CVE-2025-7118UTT HiPER 840G formPictureUrl buffer overflowUTT HiPER
- CVE-2025-7117UTT HiPER 840G websWhiteList buffer overflowUTT HiPER
- CVE-2025-7116UTT 进取 750W Fast_wireless_conf buffer overflowUTT 进取
- CVE-2025-53473Server-side request forgery (SSRF) vulnerability exists n multiple versions of Nimesa Backup and Recovery, If this vulnerability is exploiteNimesa Backup and Recovery
- CVE-2025-7145TeamT5｜ThreatSonar Anti-Ransomware - OS Command InjectionTeamT5 ThreatSonar Anti-Ransomware
- CVE-2025-53169Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this Huawei HarmonyOS
- CVE-2023-51232Directory Traversal vulnerability in dagster-webserver Dagster thru 1.5.11 allows remote attackers to obtain sensitive information via craftdagster
- CVE-2024-25177LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Se
- CVE-2025-26780An issue was discovered in L2 in Samsung Mobile Processor and Modem Exynos 2400 and Modem 5400.
- CVE-2025-52492A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6.
Medium, low and unrated 113
- CVE-2025-7152Campcodes Advanced Online Voting System candidates_add.php unrestricted uploadCampcodes Advanced Online Voting System
- CVE-2025-7151Campcodes Advanced Online Voting System voters_add.php unrestricted uploadCampcodes Advanced Online Voting System
- CVE-2025-7150Campcodes Advanced Online Voting System voters_delete.php sql injectionCampcodes Advanced Online Voting System
- CVE-2025-7149Campcodes Advanced Online Voting System candidates_delete.php sql injectionCampcodes Advanced Online Voting System
- CVE-2025-7148CodeAstro Simple Hospital Management System POST Parameter patient.html cross site scriptingCodeAstro Simple Hospital Management System
- CVE-2025-7147CodeAstro Patient Record Management System login.php sql injectionCodeAstro Patient Record Management System
- CVE-2025-7144SourceCodester Best Salon Management System Admin Profile Page admin-profile.php cross site scriptingSourceCodester Best Salon Management System
- CVE-2025-7143SourceCodester Best Salon Management System Update Tax Page edit-tax.php cross site scriptingSourceCodester Best Salon Management System
- CVE-2025-53543Kestra allows Stored XSS before 0.22kestra-io kestra
- CVE-2025-7142SourceCodester Best Salon Management System search-appointment.php cross site scriptingSourceCodester Best Salon Management System
- CVE-2025-53539ReDoS in fastapi-guard's penetration attempts detectorrennf93 fastapi-guard · fastapi-guard
- CVE-2025-53496Stored XSS in MediaSearchWikimedia Foundation Mediawiki - MediaSearch Extension
- CVE-2025-7141SourceCodester Best Salon Management System Update Staff Page edit_plan.php cross site scriptingSourceCodester Best Salon Management System
- CVE-2025-6044An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices aGoogle ChromeOS
- CVE-2025-53488Stored XSS in WikiHieroWikimedia Foundation Mediawiki - WikiHiero Extension
- CVE-2025-53498Lack of Audit Logging in AbuseFilterWikimedia Foundation Mediawiki - AbuseFilter Extension
- CVE-2025-7140SourceCodester Best Salon Management System Update Staff Page edit-staff.php cross site scriptingSourceCodester Best Salon Management System
- CVE-2025-53478CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messagesWikimedia Foundation Mediawiki - CheckUser extension
- CVE-2025-7139SourceCodester Best Salon Management System Update Customer Details Page edit-customer-detailed.php cross site scriptingSourceCodester Best Salon Management System
- CVE-2025-20322Denial of Service (DoS) in Search Head Cluster through Cross-Site Request Forgery (CSRF) in Splunk EnterpriseSplunk Enterprise
- CVE-2025-20323Missing Access Control of Saved Searches in the Splunk Archiver appSplunk Enterprise
- CVE-2025-20321Membership State Change in Splunk Search Head Cluster through a Cross-Site Request Forgery (CSRF) in Splunk EnterpriseSplunk Enterprise
- CVE-2025-20325Sensitive Information Disclosure in the SHCConfig logging channel in Clustered Deployments in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2025-20319Remote Command Execution through Scripted Input Files in Splunk EnterpriseSplunk Enterprise
- CVE-2025-20324Improper Access Control in System Source Types Configuration in Splunk EnterpriseSplunk Enterprise
- CVE-2025-20320Denial of Service (DoS) through “User Interface - Views“ configuration page in Splunk EnterpriseSplunk Enterprise
- CVE-2025-20300Improper Access Control Lets Low-Privilege Users Suppress Read-Only Alerts in Splunk EnterpriseSplunk Enterprise · Splunk Cloud Platform
- CVE-2024-43190IBM Engineering Requirements Management DOORS weak authenticationIBM Engineering Requirements Management DOORS
- CVE-2025-7138SourceCodester Best Salon Management System admin-profile.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-53535Better Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routesbetter-auth
- CVE-2025-53532giscus allows unauthorized discussion creationgiscus
- CVE-2025-7137SourceCodester Best Salon Management System schedule-staff.php sql injectionSourceCodester Best Salon Management System
- CVE-2025-1351IBM Storage Virtualize privilege escalationIBM Storage Virtualize
- CVE-2025-53526WeGIA allows Stored XSS attacks in novo_memorando.phpLabRedesCefetRJ WeGIA
- CVE-2025-7136Campcodes Online Recruitment Management System view_vacancy.php sql injectionCampcodes Online Recruitment Management System
- CVE-2025-53525WebGia allows Cross-Site Scripting (XSS) in profile_familiar.php via the id_dependente parameterLabRedesCefetRJ WeGIA
- CVE-2025-53497Stored XSS in RelatedArticlesWikimedia Foundation Mediawiki - RelatedArticles Extension
- CVE-2025-53377WebGia allows Cross-Site Scripting (XSS) in cadastro_dependente_pessoa_nova.php via the id_funcionario parameterLabRedesCefetRJ WeGIA
- CVE-2025-53491XSS in FlaggedRevsWikimedia Foundation Mediawiki - FlaggedRevs Extension
- CVE-2025-7135Campcodes Online Recruitment Management System ajax.php sql injectionCampcodes Online Recruitment Management System
- CVE-2025-53375Dokploy allows attackers to read any file that the Traefik process user can accessdokploy
- CVE-2025-7259Certain Queries with Duplicate _id Fields May Cause MongoDB Server to CrashMongoDB Server
- CVE-2025-53376Dokploy allows attackers to run arbitrary OS commands on the Dokploy host.dokploy
- CVE-2025-53374Dokploy Improperly Discloses User Information via user.one Endpointdokploy
- CVE-2025-7134Campcodes Online Recruitment Management System ajax.php sql injectionCampcodes Online Recruitment Management System
- CVE-2025-53487ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messagesWikimedia Foundation Mediawiki - ApprovedRevs extension
- CVE-2025-7057Stored XSS in QuizWikimedia Foundation Mediawiki - Quiz Extension
- CVE-2025-53486WikiCategoryTagCloud: Reflected Cross-Site Scripting (XSS) via linkstyle attribute in parser functionWikimedia Foundation Mediawiki - WikiCategoryTagCloud exten…
- CVE-2025-7133CodeAstro Online Movie Ticket Booking System cross-site request forgeryCodeAstro Online Movie Ticket Booking System
- CVE-2025-6807Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure VulnerabilityMarvell QConvergeConsole
- CVE-2025-6795Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure VulnerabilityMarvell QConvergeConsole
- CVE-2025-6712MongoDB Server may be susceptible to DoS due to Accumulated Memory AllocationMongoDB Server
- CVE-2025-6711Incomplete Redaction of Sensitive Information in MongoDB Server LogsMongoDB Server
- CVE-2025-7132Campcodes Payroll Management System ajax.php sql injectionCampcodes Payroll Management System
- CVE-2025-7131Campcodes Payroll Management System ajax.php sql injectionCampcodes Payroll Management System
- CVE-2025-7056Stored XSS in UrlShortenerWikimedia Foundation Mediawiki - UrlShortener Extension
- CVE-2025-7130Campcodes Payroll Management System ajax.php sql injectionCampcodes Payroll Management System
- CVE-2025-7129Campcodes Payroll Management System ajax.php sql injectionCampcodes Payroll Management System
- CVE-2025-7128Campcodes Payroll Management System ajax.php sql injectionCampcodes Payroll Management System
- CVE-2025-7127itsourcecode Employee Management System changepassword.php sql injectionitsourcecode Employee Management System
- CVE-2025-7126itsourcecode Employee Management System adminprofile.php sql injectionitsourcecode Employee Management System
- CVE-2025-7125itsourcecode Employee Management System editempeducation.php sql injectionitsourcecode Employee Management System
- CVE-2025-7124code-projects Online Note Sharing Profile Image userprofile.php unrestricted uploadcode-projects Online Note Sharing
- CVE-2025-7123Campcodes Complaint Management System complaint-details.php sql injectionCampcodes Complaint Management System
- CVE-2025-5472Denial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama_indexrun-llama/llama_index · llama-index +1
- CVE-2025-6210Hardlink-Based Path Traversal in run-llama/llama_indexrun-llama/llama_index · llama-index-readers-obsidian +1
- CVE-2025-3777Improper Input Validation in huggingface/transformershuggingface/transformers · transformers
- CVE-2025-3264Regular Expression Denial of Service (ReDoS) in huggingface/transformershuggingface/transformers · transformers
- CVE-2025-3263Regular Expression Denial of Service (ReDoS) in huggingface/transformershuggingface/transformers · transformers
- CVE-2025-3262Regular Expression Denial of Service (ReDoS) in huggingface/transformershuggingface/transformers · transformers
- CVE-2025-3044MD5 Hash Collision in run-llama/llama_indexrun-llama/llama_index · llama-index-readers-papers +1
- CVE-2025-7122Campcodes Complaint Management System index.php sql injectionCampcodes Complaint Management System
- CVE-2025-3705OS Command Injection via USB Config LoadFrauscher FDS102 · Frauscher FDS101 +1
- CVE-2025-7121Campcodes Complaint Management System complaint-details.php sql injectionCampcodes Complaint Management System
- CVE-2025-7120Campcodes Complaint Management System check_availability.php sql injectionCampcodes Complaint Management System
- CVE-2025-7119Campcodes Complaint Management System index.php sql injectionCampcodes Complaint Management System
- CVE-2025-7115rowboatlabs rowboat Session route.ts PUT missing authenticationrowboatlabs rowboat
- CVE-2025-7114SimStudioAI sim Session route.ts POST missing authenticationSimStudioAI sim
- CVE-2025-7113Portabilis i-Educar Curricular Components Module edit cross site scriptingPortabilis i-Educar
- CVE-2025-24508Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management SuiteBroadcom Symantec IT Management Suite
- CVE-2025-7112Portabilis i-Educar Function Management Module educar_funcao_det.php cross site scriptingPortabilis i-Educar
- CVE-2025-7111Portabilis i-Educar Course Module educar_curso_det.php cross site scriptingPortabilis i-Educar
- CVE-2025-7110Portabilis i-Educar School Module educar_escola_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-7109Portabilis i-Educar Student Benefits Registration educar_aluno_beneficio_lst.php cross site scriptingPortabilis i-Educar
- CVE-2025-53186Vulnerability that allows third-party call apps to send broadcasts without verification in the audio framework module Impact: Successful expHuawei HarmonyOS · Huawei EMUI
- CVE-2025-53185Virtual address reuse issue in the memory management module, which can be exploited by non-privileged users to access released memory ImpactHuawei HarmonyOS · Huawei EMUI
- CVE-2025-53184Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function sHuawei HarmonyOS
- CVE-2025-7108risesoft-y9 Digital-Infrastructure Y9FileController.java deleteFile path traversalrisesoft-y9 Digital-Infrastructure
- CVE-2025-53183Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function sHuawei HarmonyOS
- CVE-2025-53182Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function sHuawei HarmonyOS
- CVE-2025-53181Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function sHuawei HarmonyOS
- CVE-2025-53180Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function sHuawei HarmonyOS
- CVE-2025-53179Null pointer dereference vulnerability in the PDF preview module Impact: Successful exploitation of this vulnerability may affect function sHuawei HarmonyOS
- CVE-2025-53178Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleHuawei HarmonyOS · Huawei EMUI
- CVE-2025-53177Permission bypass vulnerability in the calendar storage module Impact: Successful exploitation of this vulnerability may affect the scheduleHuawei HarmonyOS · Huawei EMUI
- CVE-2025-53176Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the fHuawei HarmonyOS
- CVE-2025-53175Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the fHuawei HarmonyOS
- CVE-2025-53174Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the fHuawei HarmonyOS
- CVE-2025-53173Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the fHuawei HarmonyOS
- CVE-2025-53172Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the fHuawei HarmonyOS
- CVE-2025-53171Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the fHuawei HarmonyOS
- CVE-2025-7107SimStudioAI sim route.ts handleLocalFile path traversalSimStudioAI sim
- CVE-2024-58117Stack overflow risk when vector images are parsed during file preview Impact: Successful exploitation of this vulnerability may affect the fHuawei HarmonyOS
- CVE-2025-53170Null pointer dereference vulnerability in the application exit cause module Impact: Successful exploitation of this vulnerability may affectHuawei HarmonyOS
- CVE-2025-53168Vulnerability of bypassing the process to start SA and use related functions on distributed cameras Impact: Successful exploitation of this Huawei HarmonyOS
- CVE-2025-53167Authentication vulnerability in the distributed collaboration framework module Impact: Successful exploitation of this vulnerability may affHuawei HarmonyOS
- CVE-2025-7103BoyunCMS curl Index.php server-side request forgeryBoyunCMS
- CVE-2025-7102BoyunCMS Server.php sql injectionBoyunCMS
- CVE-2025-7101BoyunCMS Configuration File install_ok.php code injectionBoyunCMS
- CVE-2025-7100BoyunCMS Index.php unrestricted uploadBoyunCMS
- CVE-2024-37656An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL param
- CVE-2024-37657An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component
- CVE-2024-37658An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php