CVEs published July 12, 2025
49 CVEs were published on July 12, 2025: 5 critical, 12 high.
- Published
- 49
- Critical
- 5
- High
- 12
- Medium
- 32
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 11
Most affected products
- PHPGurukul Vehicle Parking Management System
- 10
- code-projects Modern Bag
- 5
- code-projects Simple Car Rental System
- 3
- Tenda FH1201
- 3
- Campcodes Sales and Inventory System
- 2
- iqonicdesign WPBookit
- 2
- JoeyBling SpringBoot_MyBatisPlus
- 2
- Tenda FH451
- 2
- 1000projects ABC Courier Management
- 1
- AIT Themes AIT CSV import/export
- 1
Critical 5
- CVE-2020-36849AIT CSV import/export <= 3.0.3 - Unauthenticated Arbitrary File UploadAIT Themes AIT CSV import/export
- CVE-2020-36847Simple File List < 4.2.3 - Remote Code Executioneemitch Simple File List
- CVE-2025-6058WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Uploadiqonicdesign WPBookit
- CVE-2024-38648A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including uIvanti DSM
- CVE-2023-38036A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overfIvanti Avalanche
High 12
- CVE-2025-7506Tenda FH451 HTTP POST Request Natlimit fromNatlimit stack-based overflowTenda FH451
- CVE-2025-7505Tenda FH451 HTTP POST Request L7Prot frmL7ProtForm stack-based overflowTenda FH451
- CVE-2024-41169Apache Zeppelin: raft directory listing and file readApache Software Foundation Apache Zeppelin · org.apache.… +1
- CVE-2020-36848Total Upkeep by BoldGrid <= 1.14.9 - Unauthenticated Backup DownloadTotal Upkeep – WordPress Backup Plugin plus Restore & Migra…
- CVE-2025-7468Tenda FH1201 HTTP POST Request fromSafeUrlFilter buffer overflowTenda FH1201
- CVE-2025-7504Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injectionakirk Friends
- CVE-2025-6423BeeTeam368 Extensions <= 2.3.5 - Authenticated (Subscriber+) Arbitrary File UploadBeeTeam368 Extensions
- CVE-2025-7465Tenda FH1201 HTTP POST Request fromRouteStatic buffer overflowTenda FH1201
- CVE-2025-7463Tenda FH1201 HTTP POST Request AdvSetWrlsafeset formWrlsafeset buffer overflowTenda FH1201
- CVE-2025-1313Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeoverscriptsbundle Nokri – Job Board WordPress Theme
- CVE-2025-6057WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Uploadiqonicdesign WPBookit
- CVE-2025-24294The attack vector is a potential Denial of Service (DoS).Ruby resolv · resolv
Medium, low and unrated 32
- CVE-2025-7508code-projects Modern Bag product-update.php sql injectioncode-projects Modern Bag
- CVE-2025-7492PHPGurukul Vehicle Parking Management System manage-incomingvehicle.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7491PHPGurukul Vehicle Parking Management System manage-outgoingvehicle.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7490PHPGurukul Vehicle Parking Management System reg-users.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7489PHPGurukul Vehicle Parking Management System search-vehicle.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7488JoeyBling SpringBoot_MyBatisPlus download path traversalJoeyBling SpringBoot_MyBatisPlus
- CVE-2025-7487JoeyBling SpringBoot_MyBatisPlus upload SysFileController unrestricted uploadJoeyBling SpringBoot_MyBatisPlus
- CVE-2025-7485Open5GS SCTP Partial Message recv_handler assertionOpen5GS
- CVE-2025-7484PHPGurukul Vehicle Parking Management System view-outgoingvehicle-detail.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7483PHPGurukul Vehicle Parking Management System forgot-password.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7482PHPGurukul Vehicle Parking Management System print.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7481PHPGurukul Vehicle Parking Management System profile.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7480PHPGurukul Vehicle Parking Management System signup.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7479PHPGurukul Vehicle Parking Management System view--detail.php sql injectionPHPGurukul Vehicle Parking Management System
- CVE-2025-7478code-projects Modern Bag category-list.php sql injectioncode-projects Modern Bag
- CVE-2025-7477code-projects Simple Car Rental System add_cars.php unrestricted uploadcode-projects Simple Car Rental System
- CVE-2025-7476code-projects Simple Car Rental System approve.php sql injectioncode-projects Simple Car Rental System
- CVE-2025-7475code-projects Simple Car Rental System pay.php sql injectioncode-projects Simple Car Rental System
- CVE-2025-7474code-projects Job Diary search.php sql injectioncode-projects Job Diary
- CVE-2025-7471code-projects Modern Bag login-back.php sql injectioncode-projects Modern Bag
- CVE-2025-36104IBM Storage Scale information disclosureIBM Storage Scale
- CVE-2021-4458Modern Events Calendar Lite <= 6.3.0 - Unauthenticated SQL Injectionwebnus/ Modern Events Calendar Lite
- CVE-2025-7470Campcodes Sales and Inventory System product_add.php unrestricted uploadCampcodes Sales and Inventory System
- CVE-2025-7469Campcodes Sales and Inventory System product_add.php sql injectionCampcodes Sales and Inventory System
- CVE-2025-7518RSFirewall! <= 1.1.42 - Authenticated (Admin+) Arbitrary File Readrsjoomla RSFirewall!
- CVE-2025-7467code-projects Modern Bag product-detail.php sql injectioncode-projects Modern Bag
- CVE-2025-74661000projects ABC Courier Management add_dealerrequest.php sql injection1000projects ABC Courier Management
- CVE-2025-7464osrg GoBGP rtr.go SplitRTR out-of-boundsosrg GoBGP
- CVE-2025-7462Artifex GhostPDL New Output File Open Error gdevpdf.c pdf_ferror null pointer dereferenceArtifex GhostPDL
- CVE-2025-7461code-projects Modern Bag action.php sql injectioncode-projects Modern Bag
- CVE-2023-39339A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary fiIvanti Policy Secure
- CVE-2023-39338Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the senIvanti Sentry