# CVEs published 2025-07-13

49 CVEs were published on July 13, 2025: 0 critical, 14 high. Days are UTC.

- [CVE-2025-7553](https://cve.now/CVE-2025-7553.md): D-Link DIR-818LW System Time Page os command injection (CVSS 5.1, D-Link DIR-818LW)
- [CVE-2025-1384](https://cve.now/CVE-2025-1384.md): Least Privilege Violation Vulnerability in the communications functions of NJ/NX-series Machine Automation Controllers (CVSS 7.0, OMRON Machine Automation Controller NJ-series · OMRON Ma… +1)
- [CVE-2025-7552](https://cve.now/CVE-2025-7552.md): Dromara Northstar Path AuthorizationInterceptor.java preHandle access control (CVSS 5.3, Dromara Northstar)
- [CVE-2025-7551](https://cve.now/CVE-2025-7551.md): Tenda FH1201 PPTPDClient fromPptpUserAdd stack-based overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2025-7550](https://cve.now/CVE-2025-7550.md): Tenda FH1201 GstDhcpSetSer fromGstDhcpSetSer stack-based overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2025-7549](https://cve.now/CVE-2025-7549.md): Tenda FH1201 L7Prot frmL7ProtForm stack-based overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2025-7548](https://cve.now/CVE-2025-7548.md): Tenda FH1201 SafeEmailFilter formSafeEmailFilter stack-based overflow (CVSS 8.7, Tenda FH1201)
- [CVE-2025-1735](https://cve.now/CVE-2025-1735.md): pgsql extension does not check for errors during escaping (CVSS 5.9, PHP Group PHP)
- [CVE-2025-1220](https://cve.now/CVE-2025-1220.md): Null byte termination in hostnames (CVSS 3.7, PHP Group PHP)
- [CVE-2025-7547](https://cve.now/CVE-2025-7547.md): Campcodes Online Movie Theater Seat Reservation System admin\_class.php save\_movie unrestricted upload (CVSS 6.9, Campcodes Online Movie Theater Seat Reservation System)
- [CVE-2025-6491](https://cve.now/CVE-2025-6491.md): NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix (CVSS 5.9, PHP Group PHP)
- [CVE-2025-7546](https://cve.now/CVE-2025-7546.md): GNU Binutils elf.c bfd\_elf\_set\_group\_contents out-of-bounds write (CVSS 4.8, GNU Binutils)
- [CVE-2025-7545](https://cve.now/CVE-2025-7545.md): GNU Binutils objcopy.c copy\_section heap-based overflow (CVSS 4.8, GNU Binutils)
- [CVE-2025-7544](https://cve.now/CVE-2025-7544.md): Tenda AC1206 setMacFilterCfg formSetMacFilterCfg stack-based overflow (CVSS 8.7, Tenda AC1206)
- [CVE-2025-7543](https://cve.now/CVE-2025-7543.md): PHPGurukul User Registration & Login and User Management System manage-users.php sql injection (CVSS 5.3, PHPGurukul User Registration & Login and User Management Sy…)
- [CVE-2025-7542](https://cve.now/CVE-2025-7542.md): PHPGurukul User Registration & Login and User Management System user-profile.php sql injection (CVSS 6.9, PHPGurukul User Registration & Login and User Management Sy…)
- [CVE-2025-7541](https://cve.now/CVE-2025-7541.md): code-projects Online Appointment Booking System get\_town.php sql injection (CVSS 6.9, code-projects Online Appointment Booking System)
- [CVE-2025-7540](https://cve.now/CVE-2025-7540.md): code-projects Online Appointment Booking System getclinic.php sql injection (CVSS 6.9, code-projects Online Appointment Booking System)
- [CVE-2025-7539](https://cve.now/CVE-2025-7539.md): code-projects Online Appointment Booking System getdoctordaybooking.php sql injection (CVSS 6.9, code-projects Online Appointment Booking System)
- [CVE-2025-7538](https://cve.now/CVE-2025-7538.md): Campcodes Sales and Inventory System product\_update.php unrestricted upload (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-7537](https://cve.now/CVE-2025-7537.md): Campcodes Sales and Inventory System product\_update.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-7536](https://cve.now/CVE-2025-7536.md): Campcodes Sales and Inventory System receipt\_credit.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-7535](https://cve.now/CVE-2025-7535.md): Campcodes Sales and Inventory System reprint\_cash.php sql injection (CVSS 6.9, Campcodes Sales and Inventory System)
- [CVE-2025-7534](https://cve.now/CVE-2025-7534.md): PHPGurukul Student Result Management System GET Parameter notice-details.php sql injection (CVSS 6.9, PHPGurukul Student Result Management System)
- [CVE-2025-7533](https://cve.now/CVE-2025-7533.md): code-projects Job Diary view-details.php sql injection (CVSS 6.9, code-projects Job Diary)
- [CVE-2025-7532](https://cve.now/CVE-2025-7532.md): Tenda FH1202 webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2025-7531](https://cve.now/CVE-2025-7531.md): Tenda FH1202 PPTPUserSetting fromPptpUserSetting stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2025-7530](https://cve.now/CVE-2025-7530.md): Tenda FH1202 PPTPDClient fromPptpUserAdd stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2025-7529](https://cve.now/CVE-2025-7529.md): Tenda FH1202 Natlimit fromNatlimit stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2025-7528](https://cve.now/CVE-2025-7528.md): Tenda FH1202 GstDhcpSetSer fromGstDhcpSetSer stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2025-7527](https://cve.now/CVE-2025-7527.md): Tenda FH1202 AdvSetWan fromAdvSetWan stack-based overflow (CVSS 8.7, Tenda FH1202)
- [CVE-2025-7525](https://cve.now/CVE-2025-7525.md): TOTOLINK T6 HTTP POST Request cstecgi.cgi setTracerouteCfg command injection (CVSS 5.3, TOTOLINK T6)
- [CVE-2025-7524](https://cve.now/CVE-2025-7524.md): TOTOLINK T6 HTTP POST Request cstecgi.cgi setDiagnosisCfg command injection (CVSS 5.3, TOTOLINK T6)
- [CVE-2025-7012](https://cve.now/CVE-2025-7012.md): Cato Networks Linux Client Local Privilege Escalation via Symlink (CVSS 8.6, Cato Networks Cato Client)
- [CVE-2025-7523](https://cve.now/CVE-2025-7523.md): Jinher OA DelTemp.aspx xml external entity reference (CVSS 6.9, Jinher OA)
- [CVE-2025-7522](https://cve.now/CVE-2025-7522.md): PHPGurukul Vehicle Parking Management System bwdates-reports-details.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7521](https://cve.now/CVE-2025-7521.md): PHPGurukul Vehicle Parking Management System index.php sql injection (CVSS 6.9, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7520](https://cve.now/CVE-2025-7520.md): PHPGurukul Vehicle Parking Management System manage-category.php sql injection (CVSS 5.3, PHPGurukul Vehicle Parking Management System)
- [CVE-2025-7517](https://cve.now/CVE-2025-7517.md): code-projects Online Appointment Booking System getDay.php sql injection (CVSS 6.9, code-projects Online Appointment Booking System)
- [CVE-2025-7516](https://cve.now/CVE-2025-7516.md): code-projects Online Appointment Booking System cancelbookingpatient.php sql injection (CVSS 6.9, code-projects Online Appointment Booking System)
- [CVE-2025-7515](https://cve.now/CVE-2025-7515.md): code-projects Online Appointment Booking System ulocateus.php sql injection (CVSS 6.9, code-projects Online Appointment Booking System)
- [CVE-2025-7514](https://cve.now/CVE-2025-7514.md): code-projects Modern Bag contact-list.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-7513](https://cve.now/CVE-2025-7513.md): code-projects Modern Bag slideupdate.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-7512](https://cve.now/CVE-2025-7512.md): code-projects Modern Bag contact-back.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-7511](https://cve.now/CVE-2025-7511.md): code-projects Chat System update\_account.php sql injection (CVSS 5.3, code-projects Chat System)
- [CVE-2025-7510](https://cve.now/CVE-2025-7510.md): code-projects Modern Bag productadd\_back.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2025-7509](https://cve.now/CVE-2025-7509.md): code-projects Modern Bag slide.php sql injection (CVSS 6.9, code-projects Modern Bag)
- [CVE-2024-58258](https://cve.now/CVE-2024-58258.md): SugarCRM before 13.0.4 and 14.x before 14.0.1 allows SSRF in the API module because a limited type of code injection can occur. (CVSS 7.2, SugarCRM)
- [CVE-2025-53865](https://cve.now/CVE-2025-53865.md): In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive). (CVSS 6.4, roundup-tracker Roundup · roundup)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-07-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.