# CVEs published 2025-07-12

49 CVEs were published on July 12, 2025: 5 critical, 12 high. Days are UTC.

- [CVE-2025-7508](https://cve.now/CVE-2025-7508.md): code-projects Modern Bag product-update.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-7506](https://cve.now/CVE-2025-7506.md): Tenda FH451 HTTP POST Request Natlimit fromNatlimit stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2025-7505](https://cve.now/CVE-2025-7505.md): Tenda FH451 HTTP POST Request L7Prot frmL7ProtForm stack-based overflow (CVSS 8.7, Tenda FH451)
- [CVE-2025-7492](https://cve.now/CVE-2025-7492.md): PHPGurukul Vehicle Parking Management System manage-incomingvehicle.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7491](https://cve.now/CVE-2025-7491.md): PHPGurukul Vehicle Parking Management System manage-outgoingvehicle.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7490](https://cve.now/CVE-2025-7490.md): PHPGurukul Vehicle Parking Management System reg-users.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7489](https://cve.now/CVE-2025-7489.md): PHPGurukul Vehicle Parking Management System search-vehicle.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7488](https://cve.now/CVE-2025-7488.md): JoeyBling SpringBoot\_MyBatisPlus download path traversal (CVSS 5.3, JoeyBling SpringBoot\_MyBatisPlus)
- [CVE-2025-7487](https://cve.now/CVE-2025-7487.md): JoeyBling SpringBoot\_MyBatisPlus upload SysFileController unrestricted upload (CVSS 5.3, JoeyBling SpringBoot\_MyBatisPlus)
- [CVE-2025-7485](https://cve.now/CVE-2025-7485.md): Open5GS SCTP Partial Message recv\_handler assertion (CVSS 4.8, Open5GS)
- [CVE-2025-7484](https://cve.now/CVE-2025-7484.md): PHPGurukul Vehicle Parking Management System view-outgoingvehicle-detail.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7483](https://cve.now/CVE-2025-7483.md): PHPGurukul Vehicle Parking Management System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7482](https://cve.now/CVE-2025-7482.md): PHPGurukul Vehicle Parking Management System print.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7481](https://cve.now/CVE-2025-7481.md): PHPGurukul Vehicle Parking Management System profile.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2024-41169](https://cve.now/CVE-2024-41169.md): Apache Zeppelin: raft directory listing and file read (CVSS 7.5, Apache Software Foundation Apache Zeppelin · org.apache.… +1)
- [CVE-2025-7480](https://cve.now/CVE-2025-7480.md): PHPGurukul Vehicle Parking Management System signup.php sql injection (CVSS 6.9, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7479](https://cve.now/CVE-2025-7479.md): PHPGurukul Vehicle Parking Management System view--detail.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7478](https://cve.now/CVE-2025-7478.md): code-projects Modern Bag category-list.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-7477](https://cve.now/CVE-2025-7477.md): code-projects Simple Car Rental System add\_cars.php unrestricted upload (CVSS 5.1, code-projects Simple Car Rental System)
- [CVE-2025-7476](https://cve.now/CVE-2025-7476.md): code-projects Simple Car Rental System approve.php sql injection (CVSS 6.9, code-projects Simple Car Rental System)
- [CVE-2025-7475](https://cve.now/CVE-2025-7475.md): code-projects Simple Car Rental System pay.php sql injection (CVSS 6.9, code-projects Simple Car Rental System)
- [CVE-2025-7474](https://cve.now/CVE-2025-7474.md): code-projects Job Diary search.php sql injection (CVSS 6.9, code-projects Job Diary)
- [CVE-2025-7471](https://cve.now/CVE-2025-7471.md): code-projects Modern Bag login-back.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-36104](https://cve.now/CVE-2025-36104.md): IBM Storage Scale information disclosure (CVSS 6.5, IBM Storage Scale)
- [CVE-2020-36849](https://cve.now/CVE-2020-36849.md): AIT CSV import/export \<= 3.0.3 - Unauthenticated Arbitrary File Upload (CVSS 9.8, AIT Themes AIT CSV import/export)
- [CVE-2020-36848](https://cve.now/CVE-2020-36848.md): Total Upkeep by BoldGrid \<= 1.14.9 - Unauthenticated Backup Download (CVSS 7.5, Total Upkeep – WordPress Backup Plugin plus Restore & Migra…)
- [CVE-2021-4458](https://cve.now/CVE-2021-4458.md): Modern Events Calendar Lite \<= 6.3.0 - Unauthenticated SQL Injection (CVSS 5.9, webnus/ Modern Events Calendar Lite)
- [CVE-2025-7470](https://cve.now/CVE-2025-7470.md): Campcodes Sales and Inventory System product\_add.php unrestricted upload (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-7469](https://cve.now/CVE-2025-7469.md): Campcodes Sales and Inventory System product\_add.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-7518](https://cve.now/CVE-2025-7518.md): RSFirewall! \<= 1.1.42 - Authenticated (Admin+) Arbitrary File Read (CVSS 4.9, rsjoomla RSFirewall!)
- [CVE-2020-36847](https://cve.now/CVE-2020-36847.md): Simple File List \< 4.2.3 - Remote Code Execution (CVSS 9.8, eemitch Simple File List)
- [CVE-2025-7468](https://cve.now/CVE-2025-7468.md): Tenda FH1201 HTTP POST Request fromSafeUrlFilter buffer overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2025-7467](https://cve.now/CVE-2025-7467.md): code-projects Modern Bag product-detail.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-7504](https://cve.now/CVE-2025-7504.md): Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection (CVSS 7.5, akirk Friends)
- [CVE-2025-7466](https://cve.now/CVE-2025-7466.md): 1000projects ABC Courier Management add\_dealerrequest.php sql injection (CVSS 6.9, 1000projects ABC Courier Management)
- [CVE-2025-6423](https://cve.now/CVE-2025-6423.md): BeeTeam368 Extensions \<= 2.3.5 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, BeeTeam368 Extensions)
- [CVE-2025-7465](https://cve.now/CVE-2025-7465.md): Tenda FH1201 HTTP POST Request fromRouteStatic buffer overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2025-7464](https://cve.now/CVE-2025-7464.md): osrg GoBGP rtr.go SplitRTR out-of-bounds (CVSS 6.3, osrg GoBGP)
- [CVE-2025-7463](https://cve.now/CVE-2025-7463.md): Tenda FH1201 HTTP POST Request AdvSetWrlsafeset formWrlsafeset buffer overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2025-7462](https://cve.now/CVE-2025-7462.md): Artifex GhostPDL New Output File Open Error gdevpdf.c pdf\_ferror null pointer dereference (CVSS 5.3, Artifex GhostPDL)
- [CVE-2025-1313](https://cve.now/CVE-2025-1313.md): Nokri - Job Board WordPress Theme \<= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover (CVSS 8.8, scriptsbundle Nokri – Job Board WordPress Theme)
- [CVE-2025-7461](https://cve.now/CVE-2025-7461.md): code-projects Modern Bag action.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-6057](https://cve.now/CVE-2025-6057.md): WPBookit \<= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, iqonicdesign WPBookit)
- [CVE-2025-6058](https://cve.now/CVE-2025-6058.md): WPBookit \<= 1.0.4 - Unauthenticated Arbitrary File Upload (CVSS 9.8, iqonicdesign WPBookit)
- [CVE-2023-39339](https://cve.now/CVE-2023-39339.md): A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary fi (CVSS 4.9, Ivanti Policy Secure)
- [CVE-2023-39338](https://cve.now/CVE-2023-39338.md): Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sen (CVSS 6.8, Ivanti Sentry)
- [CVE-2024-38648](https://cve.now/CVE-2024-38648.md): A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including u (CVSS 9.0, Ivanti DSM)
- [CVE-2023-38036](https://cve.now/CVE-2023-38036.md): A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overf (CVSS 9.8, Ivanti Avalanche)
- [CVE-2025-24294](https://cve.now/CVE-2025-24294.md): The attack vector is a potential Denial of Service (DoS). (CVSS 7.5, Ruby resolv · resolv)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.